Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Filebeat to logstash connection refused

I'm trying to send log files from filebeat->logstash->elastic search. filebeat.yml. But I'm getting the following error in filebeat log:

2017-12-07T16:15:38+05:30 ERR  Failed to connect: dial tcp [::1]:5044: connectex: No connection could be made because the target machine actively refused it.

My filebeat and logstash configurations are as follows:

1.filebeat.yml

filebeat.prospectors:

- input_type: log
  paths:
    - C:\Users\shreya\Data\mylog.log 
  document_type: springlog
 multiline.pattern: ^\[[0-9]{4}-[0-9]{2}-[0-9]{2}
  multiline.negate: true
  multiline.match: before
output.logstash:
  hosts: ["localhost:5044"]

2.logstash.yml

    http.host: "127.0.0.1"
    http.port: 5044

3.logstash conf file:

input {
     beats {
        port => 5044
    codec => multiline {
    pattern => "^(%{TIMESTAMP_ISO8601})"
        negate => true
        what => "previous"
    }
  }
}
filter {
    grok{
    id => "myspringlogfilter"
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}; [LOG_LEVEL=%{LOGLEVEL:log-level}, CMPNT_NM= %{GREEDYDATA:component}, MESSAGE=%{GREEDYDATA:message}" }
    overwrite => ["message"]

    }

}
output {
    elasticsearch {
        hosts => "localhost:9200" 
        manage_template => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" 
        document_type => "%{[@metadata][type]}"     
    }
    stdout {
         codec => rubydebug
  }
}
like image 515
Siena Avatar asked Nov 08 '22 13:11

Siena


1 Answers

Problem got solved after I commented out the metric settings in logstash.yml as follows:

# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
#http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
#http.port: 5044
#

But still do not know why this solved the issue. as both(filebeat and logstash) were pointing to the same port. If someone could explain the reason, then prior Thanks!

like image 83
Siena Avatar answered Nov 15 '22 08:11

Siena