0 active connection - input is running

Graylog Central (peer support)
1

1. Describe your incident:

Hello guys, I’m trying to send logs from a Debian VPS using Filebeat to Graylog. The Beats input is running, but no active connections are detected (0 active, 26,500 total). I’ve configured Filebeat to point to Graylog’s Beats input on port 5045. No logs appear in Graylog, and connection attempts seem to fail.

2. Describe your environment:

OS Information (Graylog Server): Ubuntu (via Docker)
OS Information (Filebeat Client): Debian 12 (kernel 6.1.135-1)
Deployment: Docker Compose

Package Versions:

Network:

  • Filebeat client: Public IP
  • Graylog server: Public IP

3. What steps have you already taken to try and solve the problem?

  • Verified Beats input on Graylog is active (port 5045)
  • Checked Filebeat service is running
  • Confirmed firewall/iptables allows port 5045
  • Tried testing with telnet ip publik graylog server → connection succes
  • Checked journalctl -u filebeat for logs (no errors found)
  • Ensured Graylog’s input binds to 0.0.0.0

4. How can the community help?

  • Is there anything wrong with my Filebeat or Beats input config?
  • Why does Graylog show 0 active connections even though input is running?
  • Do I need additional configuration on Docker Graylog or Filebeat to make this connection succeed?
2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.