# When I install x-pack, filebeat can not connect to Logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 14, 2017, 10:35am UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166 "2017-07-14T10:35:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dog](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@dog](https://discuss.elastic.co/u/dog)\ **Post date:** [July 14, 2017, 10:35am UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166/1 "2017-07-14T10:35:29Z")
Before I installed x-pack, everything worked well. When I installed x-pack, I received a 401 error and I configured the user according to the official document. But my filebeat can not connect to logstash. Logstash error message: [WARN] [logstash.agent] crisis pipeline {: id =\> ". Monitoring-logstash"} Filebeat error message:ERR Connecting error publishing events (retrying): dial tcp 192.168.117.150:50 44: connectex: No connection could be made because the target machine actively refused it. This is my Logstash configuration file： input { beats { port =\> "5043" ssl =\> false } } filter { if [message] =~ "^#" { drop {} } grok { match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:sitename} %{IPORHOST:serverip} %{WORD:method} %{URIPATH:uri-stem} %{NOTSPACE:uri-query} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientip} %{NOTSPACE:useragent} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time\_taken}"} } date { locale =\> "en" match =\> ["log\_timestamp","YYYY-MM-dd HH:mm:ss"] timezone =\> "Etc/UTC" remove\_field =\> ["log\_timestamp"] } mutate { remove\_field =\> ["message","tags","input\_type","beat"] } } output { elasticsearch { hosts =\> ["localhost:9200"] document\_type =\> "iis\_log" index =\> "dog-%{+YYYY.MM.dd}" user =\> logstash-index password =\> password } } This is my filebeat configuration file filebeat.prospectors: - input\_type: log paths: - C:\inetpub\logs\LogFiles\W3SVC\* document\_type: iis\_log output.logstash: hosts: ["192.168.1.101:5043"] bulk\_max\_size: 1024 Because i am copying, so their format is like wrong. In the test environment, the configuration file format is correct ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 17, 2017, 11:06pm UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166/2 "2017-07-17T23:06:22Z")
Looks more like a logstash problem. It's logstash refusing to accept a new connection from beats. 401 in logstash or filebeat? filebeat -\> logstash is not HTTP. ---
**Author:** ![dog](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@dog](https://discuss.elastic.co/u/dog)\ **Post date:** [July 27, 2017, 1:47am UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166/3 "2017-07-27T01:47:56Z")
thinks，I solved these problems, the problem is because the logstash filter in the field less one. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 24, 2017, 1:59am UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166/4 "2017-08-24T01:59:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.