Unable to connect to Beats input on Logstash

Elastic Stack Beats
#1

Hi,

I am running logstash service on a Ubuntu image in Virtual Box. When I try to connect to the beats service using curl http://localhost:5044 I get the below error.

curl: (56) Recv failure: Connection reset by peer

I tried to debug the same using curl http://localhost:5044 --trace-ascii dump.txt, below is the output

== Info: Rebuilt URL to: http://localhost:5044/
== Info: Hostname was NOT found in DNS cache
== Info:   Trying 127.0.0.1...
== Info: Connected to localhost (127.0.0.1) port 5044 (#0)
=> Send header, 78 bytes (0x4e)
0000: GET / HTTP/1.1
0010: User-Agent: curl/7.38.0
0029: Host: localhost:5044
003f: Accept: */*
004c:
== Info: Recv failure: Connection reset by peer
== Info: Closing connection 0

I have disabled the firewall and netstat -plnt | grep '5044' gives the below:

tcp6       0      0 :::5044                 :::*                    LISTEN

Here is my logstash .conf file:

input {
  beats {
    port => 5044
  }
}

output {
  stdout { }
  elasticsearch { }
}

I'm running Logstash 5.3.0, Ubuntu 15.04 over VirtualBox 5.1 on a Windows 10 machine.

Thanks a lot for the time!
Vinay.

#2

What happens when you run telnet on the beat host to the Logstash host? Make sure Logstash is running.

telnet LOGSTASH_HOST_IP 5044

#3

Telnet from the remote host works but a curl fails, I should have mentioned that earlier. I did not mention anything about the remote host because I cannot connect to beats from the same virtual machine on which logstash is running.

How do I test beats? Is curl "http://localhost:5044" a good way of going about it?

#4

the beats input is not using HTTP. That's why the connection is reset by peer (meaning closed by Logstash).

#5

Ok. So how do i go about testing if beats is running properly? I checked the filebeat logs and it says connection refused while trying to connect to beats. I've tried pretty much everything by now.

#6

have you tried telnet?

#7

I see you've been trying telnet. Can you share filebeat config and logs?

Please format your post using the </>-button. Mixing files with text content makes an very unreadable post otherwise.

#8

This topic was automatically closed after 21 days. New replies are no longer allowed.