# Winlogbeat not able to send log to the logstash **URL:** \ **Category:** Logstash\ **Created:** [May 2, 2020, 10:07pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833 "2020-05-02T22:07:22Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![srv95](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srv95/32/67603_2.png) [@srv95](https://discuss.elastic.co/u/srv95)\ **Post date:** [May 2, 2020, 10:07pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/1 "2020-05-02T22:07:22Z")
emstats":{"gc\_next":57446288,"memory\_alloc":28758904,"memory\_total":636265600},"runtime":{"goroutines":28}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"errors":1},"write":{"bytes":124}},"pipeline":{"clients":3,"events":{"active":4119,"retry":50}}}}}} 2020-05-03T03:31:45.550+0530 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch([http://52.66.120.80:5044](http://52.66.120.80:5044))): Get [http://52.66.120.80:5044](http://52.66.120.80:5044): read tcp 192.168.0.115:20072-\>52.66.120.80:5044: wsarecv: An existing connection was forcibly closed by the remote host. 2020-05-03T03:31:45.550+0530 INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch([http://52.66.120.80:5044](http://52.66.120.80:5044))) with 16 reconnect attempt(s) 2020-05-03T03:31:45.550+0530 INFO [publisher] pipeline/retry.go:196 retryer: send unwait-signal to consumer 2020-05-03T03:31:45.553+0530 DEBUG [elasticsearch] elasticsearch/client.go:733 ES Ping(url=http://52.66.120.80:5044) 2020-05-03T03:31:45.553+0530 INFO [publisher] pipeline/retry.go:198 done 2020-05-03T03:31:45.554+0530 INFO [publisher] pipeline/retry.go:173 retryer: send wait signal to consumer 2020-05-03T03:31:45.554+0530 INFO [publisher] pipeline/retry.go:175 done 2020-05-03T03:31:45.629+0530 DEBUG [elasticsearch] elasticsearch/client.go:737 Ping request failed with: Get [http://52.66.120.80:5044](http://52.66.120.80:5044): read tcp 192.168.0.115:20077-\>52.66.120.80:5044: wsarecv: An existing connection was forcibly closed by the remote host. I installed ELK on AWS and Elasticsearch only accessible on localhost and Kibana on Public IP. I wish to send the logs from my local system to aws. Please tell how can I solve this. I dont want to send direct log to elasticsearch. I want Winlogbeat------\> Logstash----\> Elasticsearch ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 2, 2020, 10:48pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/2 "2020-05-02T22:48:40Z")
Hello @srv95 Winlogbeat requires a connection to Logstash or to Elasticsearch (depending which [output](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuring-output.html) you've configured in Winlogbeat). If Elasticsearch is only available on localhost (on AWS), Winlogbeat or Logstash will never be able to reach it. I would suggest enabling the security (TLS & Authentication, Authorization) using a Basic license and make Elasticsearch accessible via a public IP and/or a VPN. Once you've done so, always ensure you install the index templates if you are going through Logstash. See: - [https://www.elastic.co/guide/en/beats/winlogbeat/current/logstash-output.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/logstash-output.html) - [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually) ---
**Author:** ![srv95](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srv95/32/67603_2.png) [@srv95](https://discuss.elastic.co/u/srv95)\ **Post date:** [May 2, 2020, 11:19pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/3 "2020-05-02T23:19:15Z")
I am able to send logs Winlogbeat (LOCAL SYS) ---\> Elasticsearch (AWS )----\> Kibana without any TLS and Authentication. I just added network.host : 0.0.0.0 & able to access Elasticsearch publicly but this method is not secured. My Planning is to send the logs to the Local Sys to Logstash. Syslog-ng to Logstash. ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 2, 2020, 11:22pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/4 "2020-05-02T23:22:43Z")
I was trying to suggest a safe solution. I would not open Elasticsearch without TLS&Authentication on a Public IP. If you want to send data from Syslog to Logstash use the [`syslog` input on Logstash](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html). ---
**Author:** ![srv95](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srv95/32/67603_2.png) [@srv95](https://discuss.elastic.co/u/srv95)\ **Post date:** [May 3, 2020, 12:28am UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/5 "2020-05-03T00:28:23Z")
I am unable to access kibana after login url: [http://13.229.215.240:5601/](http://13.229.215.240:5601/) {"statusCode":403,"error":"Forbidden","message":"Forbidden"} [http://13.229.215.240:5601/app/kibana](http://13.229.215.240:5601/app/kibana) {"statusCode":404,"error":"Not Found","message":"Not Found"} Please provide me ssl installation doc also. Thank you so much!!! [ ![Mailtrack](https://us1.discourse-cdn.com/elastic/original/3X/4/2/42a0ab1f68ea0ef3f597197373c8450324414f61.gif) ](https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality5&) Sender notified by ``` [Mailtrack](https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality5&) 05/03/20, 05:58:00 AM ``` ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 3, 2020, 12:32am UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/6 "2020-05-03T00:32:48Z")
Few links: - [Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html) - [Blog article - How to setup TLS & HTTPS on Kibana, Beats, Logstash & Elasticsearch](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash) ---
**Author:** ![srv95](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srv95/32/67603_2.png) [@srv95](https://discuss.elastic.co/u/srv95)\ **Post date:** [May 3, 2020, 7:33pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/7 "2020-05-03T19:33:08Z")
2020-05-04T00:53:15.001+0530 DEBUG [winlogbeat] beater/eventlogger.go:152 EventLog[Application] Read() returned 0 records 2020-05-04T00:53:15.619+0530 DEBUG [elasticsearch] elasticsearch/client.go:737 Ping request failed with: Get [http://logs.tweetfblikes.com:5504](http://logs.tweetfblikes.com:5504): dial tcp 52.57.57.0:5504: connectex: No connection could be made because the target machine actively refused it. 2020-05-04T00:53:16.004+0530 DEBUG [eventlog\_detail] eventlog/wineventlog.go:296 WinEventLog[Application] No more events 2020-05-04T00:53:16.004+0530 DEBUG [winlogbeat] beater/eventlogger.go:152 EventLog[Application] Read() returned 0 records 2020-05-04T00:53:17.006+0530 DEBUG [eventlog\_detail] eventlog/wineventlog.go:296 WinEventLog[Application] No more events 2020-05-04T00:53:17.006+0530 DEBUG [winlogbeat] beater/eventlogger.go:152 EventLog[Application] Read() returned 0 records 2020-05-04T00:53:18.007+0530 DEBUG [eventlog\_detail] eventlog/wineventlog.go:296 WinEventLog[Application] No more events 2020-05-04T00:53:18.007+0530 DEBUG [winlogbeat] beater/eventlogger.go:152 EventLog[Application] Read() returned 0 records 2020-05-04T00:53:18.261+0530 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch([http://logs.tweetfblikes.com:5504](http://logs.tweetfblikes.com:5504))): Get [http://logs.tweetfblikes.com:5504](http://logs.tweetfblikes.com:5504): dial tcp 52.57.57.0:5504: connectex: No connection could be made because the target machine actively refused it. ---
**Author:** ![srv95](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srv95/32/67603_2.png) [@srv95](https://discuss.elastic.co/u/srv95)\ **Post date:** [May 3, 2020, 7:35pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/8 "2020-05-03T19:35:27Z")
I can able to send the logs to Elasticsearch successfully without using ssl also. But not able to send logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2020, 7:35pm UTC](https://discuss.elastic.co/t/winlogbeat-not-able-to-send-log-to-the-logstash/230833/9 "2020-05-31T19:35:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.