# Unable to connect to Beats input on Logstash

**URL:** <https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020>\
**Category:** Beats\
**Created:** [April 11, 2017, 4:55pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020 "2017-04-11T16:55:21Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vinay\_Binny](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@Vinay\_Binny](https://discuss.elastic.co/u/Vinay_Binny)\
**Post date:** [April 11, 2017, 4:55pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/1 "2017-04-11T16:55:21Z")

</div>

Hi,

I am running logstash service on a Ubuntu image in Virtual Box. When I try to connect to the beats service using `curl http://localhost:5044` I get the below error.

`curl: (56) Recv failure: Connection reset by peer`

I tried to debug the same using `curl http://localhost:5044 --trace-ascii dump.txt`, below is the output

```auto
== Info: Rebuilt URL to: http://localhost:5044/
== Info: Hostname was NOT found in DNS cache
== Info: Trying 127.0.0.1...
== Info: Connected to localhost (127.0.0.1) port 5044 (#0)
=> Send header, 78 bytes (0x4e)
0000: GET / HTTP/1.1
0010: User-Agent: curl/7.38.0
0029: Host: localhost:5044
003f: Accept: */*
004c:
== Info: Recv failure: Connection reset by peer
== Info: Closing connection 0

```

I have disabled the firewall and `netstat -plnt | grep '5044'` gives the below:

```
tcp6 0 0 :::5044 :::* LISTEN  

```

Here is my logstash .conf file:

```auto
input {
  beats {
    port => 5044
  }
}

output {
  stdout { }
  elasticsearch { }
}

```

I'm running Logstash 5.3.0, Ubuntu 15.04 over VirtualBox 5.1 on a Windows 10 machine.

Thanks a lot for the time!  
Vinay.

---

<div class="post-metadata">

**Author:** ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)\
**Post date:** [April 11, 2017, 6:53pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/2 "2017-04-11T18:53:36Z")

</div>

What happens when you run telnet on the beat host to the Logstash host? Make sure Logstash is running.

telnet LOGSTASH\_HOST\_IP 5044

---

<div class="post-metadata">

**Author:** ![Vinay\_Binny](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@Vinay\_Binny](https://discuss.elastic.co/u/Vinay_Binny)\
**Post date:** [April 12, 2017, 4:37am UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/3 "2017-04-12T04:37:39Z")

</div>

Telnet from the remote host works but a curl fails, I should have mentioned that earlier. I did not mention anything about the remote host because I cannot connect to beats from the same virtual machine on which logstash is running.

How do I test beats? Is curl "[http://localhost:5044](http://localhost:5044)" a good way of going about it?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 12, 2017, 10:08am UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/4 "2017-04-12T10:08:19Z")

</div>

the beats input is not using HTTP. That's why the connection is `reset by peer` (meaning closed by Logstash).

---

<div class="post-metadata">

**Author:** ![Vinay\_Binny](https://avatars.discourse-cdn.com/v4/letter/v/bb73d2/32.png) [@Vinay\_Binny](https://discuss.elastic.co/u/Vinay_Binny)\
**Post date:** [April 12, 2017, 11:55am UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/5 "2017-04-12T11:55:31Z")

</div>

Ok. So how do i go about testing if beats is running properly? I checked the filebeat logs and it says connection refused while trying to connect to beats. I've tried pretty much everything by now.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 12, 2017, 2:36pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/6 "2017-04-12T14:36:57Z")

</div>

have you tried telnet?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 12, 2017, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/7 "2017-04-12T14:38:47Z")

</div>

I see you've been trying telnet. Can you share filebeat config and logs?

Please format your post using the `</>`-button. Mixing files with text content makes an very unreadable post otherwise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2017, 4:55pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020/8 "2017-05-02T16:55:45Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.