# Winlogbeat actively refused by target **URL:** \ **Category:** Beats\ **Created:** [July 29, 2016, 4:48pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752 "2016-07-29T16:48:40Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 4:48pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/1 "2016-07-29T16:48:40Z")
Hi, I am very new to the ELK stack and Beats. I have a ELK stack setup on a Windows 2012 R2 server and am collecting winlogbeat, packetbeat and topbeat from the host of the ELK stack. I'm now trying to add winlogbeat to one of my domain controllers. The ELK host and DC are on the same subnet, I've installed the winlogbeat service and here is the .yml I'm using: ```auto winlogbeat: registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event_logs: - name: Application - name: Security - name: System output: logstash: hosts: ["10.20.1.27:5045"] logging: to_files: true files: path: C:/ProgramData/winlogbeat/Logs level: info ``` In the winlogbeat / logs file I see the following log error: `2016-07-29T09:45:53-07:00 INFO Connecting error publishing events (retrying): dial tcp 10.20.1.27:5045: connectex: No connection could be made because the target machine actively refused it. 2016-07-29T09:45:53-07:00 INFO send fail 2016-07-29T09:45:53-07:00 INFO backoff retry: 1m0s` By target, I assume it means the ELK host. I've tried turning off the windows Firewall, no AV is installed currently and there are no Policies on the network that would prevent this traffic from hitting the host. Any help would be appreciated. Thanks, Andrew ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 29, 2016, 6:16pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/2 "2016-07-29T18:16:05Z")
Are you able to `telnet 10.20.1.27 5045` from the host running Winlogbeat to the host running Logstash? What output does that give? It could be a firewall or AV on the Winlogbeat host too. Check those as well. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 6:55pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/3 "2016-07-29T18:55:04Z")
I am NOT able to telnet from the Winlogbeat host to the Logstash server on that port, I can telnet to it on the default telnet port and even on 5601 which is the web host port. I've turned off windows firewall on both source and destination, there is no AV on either server currently. Not sure why with windows firewall off on both clients and no AV why I can not telnet to it on any port I want. Well... Can I use 5601 to send my logs? Or is that only for the web host? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 29, 2016, 6:59pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/4 "2016-07-29T18:59:49Z")
Are you sure Logstash is both running and listening on 5045? Check that the process is still running. If not check the logs and post the config. Also check the output of netstat to verify that there is a tcp port listening on 0.0.0.0:5045. > [@Andrew\_Schulz](#): > > Can I use 5601 to send my logs? No, that's the Kibana web server. It doesn't accept data from Beats. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 7:00pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/5 "2016-07-29T19:00:00Z")
I answered my own question as to if I can use 5601. I get the following error: An existing connection was forcibly closed by the remote host. I will work to figure out why I can't connect on port 5045. This appears to be the root of the issue. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 7:04pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/6 "2016-07-29T19:04:44Z")
Logstash is running as a service, I restarted it and then checked netstat but don't see 5045 as listening. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 29, 2016, 7:06pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/7 "2016-07-29T19:06:25Z")
Please post your Logstash config. Use the `` button for code formatting. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 7:17pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/8 "2016-07-29T19:17:05Z")
```auto input { stdin { } } output { elasticsearch { hosts => ["localhost:5045"] } stdout { codec => rubydebug } } ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 29, 2016, 7:21pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/9 "2016-07-29T19:21:21Z")
Please check out the documentation on how to use Winlogbeat with Logstash. [Step 3: Configuring Winlogbeat to Use Logstash](https://www.elastic.co/guide/en/beats/winlogbeat/current/config-winlogbeat-logstash.html) [Setting Up Logstash](https://www.elastic.co/guide/en/beats/libbeat/1.2/logstash-installation.html#logstash-setup) You are missing a beats input and you need a few more parameters in your elasticsearch output. Then you should be good to go. 🙂 ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 7:54pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/10 "2016-07-29T19:54:36Z")
Thanks for the documentation links. I went through both of those and made the necessary changes. After making the changes my Kibana is returning the following error: Error: unknown error at respond ([http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:77673:16](http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:77673:16)) at checkRespForFailure ([http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:77634:8](http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:77634:8)) at [http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:76252:8](http://10.20.1.27:5601/bundles/kibana.bundle.js?v=9910:76252:8) at processQueue ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:42385:29](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:42385:29)) at [http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:42401:28](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:42401:28) at Scope.$eval ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43629:29](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43629:29)) at Scope.$digest ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43440:32](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43440:32)) at Scope.$apply ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43737:25](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:43737:25)) at done ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:38186:48](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:38186:48)) at completeRequest ([http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:38384:8](http://10.20.1.27:5601/bundles/commons.bundle.js?v=9910:38384:8)) Not sure what happened. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 7:59pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/11 "2016-07-29T19:59:27Z")
Solved this bundles issue. Now back to the beats. ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 8:46pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/12 "2016-07-29T20:46:52Z")
Okay, So I've run through both documents and made the necessary changes, however I still don't see a port open for logstash on 5044 using netstat. So to update: Here is my winlogbeat.yml from the DC i am shipping the logs from. ```auto winlogbeat: registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event_logs: - name: Application - name: Security - name: System output: logstash: hosts: ["10.20.1.27:5044"] logging: to_files: true files: path: C:/ProgramData/winlogbeat/Logs level: info` ``` Then here is the logstash.conf from the ELK server ```auto input { beats { port => 5044 } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` Something interesting is that with the other beats files such as winlogbeat, topbeat, packetbeat, I see those in the Windows C:\ProgramData folder with Logs in each, however logstash is not listed in C:\ProgramData. Not sure if that is normal, but doesn't seem consistent. Andrew ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 29, 2016, 9:04pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/13 "2016-07-29T21:04:03Z")
Logstash writes to stdout by default. So you want to get more verbose information logged to stdout you can add flags like `--verbose` or `--debug`, and if you want that data logged to a file you can use `--log FILE`. See [Logstash Command-line flags](https://www.elastic.co/guide/en/logstash/current/command-line-flags.html). ---
**Author:** ![Andrew\_Schulz](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@Andrew\_Schulz](https://discuss.elastic.co/u/Andrew_Schulz)\ **Post date:** [July 29, 2016, 10:11pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/14 "2016-07-29T22:11:55Z")
Here is the log output PS C:\elk-stack\logstash\> bin\logstash.bat -f logstash.conf -v --debug --verbose io/console not supported; tty will not be manipulated ←[32mstarting agent {:level=\>:info}←[0m ←[32mstarting pipeline {:id=\>"main", :level=\>:info}←[0m Settings: Default pipeline workers: 8 ←[32mBeats inputs: Starting input listener {:address=\>"0.0.0.0:5044", :level=\>:info}←[0m ←[32mNew Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["localhost:9200"], :level=\>:info}←[0 m ←[32mStarting pipeline {:id=\>"main", :pipeline\_workers=\>8, :batch\_size=\>125, :batch\_delay=\>5, :max\_inflight=\>1000, :leve l=\>:info}←[0m Pipeline main started It hangs at pipeline main started. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 19, 2016, 4:48pm UTC](https://discuss.elastic.co/t/winlogbeat-actively-refused-by-target/56752/15 "2016-08-19T16:48:48Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.