The filebeat and logstash connections will be refused

Elastic Stack Beats
1

I want filebeat and logstash to communicate with each other to collect multiple log files.
I have run the following test command for filebeat, but the connection is refused.
What is the reason for this?
filebeat -e -c filebeat.yml test output

I will report the error, the yml file used for testing, and the status of the open 5044port.

# filebeat -e -c filebeat.yml test output
2021-03-03T20:24:39.255+0900    INFO    instance/beat.go:660    Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2021-03-03T20:24:39.255+0900    INFO    instance/beat.go:668    Beat ID: ****
logstash: ***.***.***.***:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: ***.***.***.***
    dial up... ERROR dial tcp ***.***.***.***:5044: connect: connection refused

# cat filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log*
  tags: ["nginx-access"]
  exclude_files: ['.gz$']

output.logstash:
  hosts: ["***.***.***.***:5044"]

filebeat.config.modules:
  enabled: true
  path: ${path.config}/modules.d/*.yml

# firewall-cmd --add-port=5044/tcp --permanent
success
# firewall-cmd --reload
success
# firewall-cmd --list-ports --permanent
5044/tcp
2

Connection refused means that the connectivity from the logstash side was refused, so I am thinking it would be either related to network connectivity, firewalls, authentication settings on the logstash side, maybe some tls?

Connection refused at least should rule out routing or firewalls, as the application would usually actively refuse it (logstash that is).

Maybe you could tail the logstash logs while running filebeat to see?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.