Filebeat refused by target machine

Graylog Central (peer support)
1

In fact i have config the BEAT INPUT and in collector i have alredy config the Configure Beats Outputs and Configure Beats inputs.

And when I run the “Graylog-collector-sidecar.exe” it seem nothing wrong

time="2017-11-23T17:31:19+08:00" level=info msg="Starting signal distributor" 
time="2017-11-23T17:31:19+08:00" level=info msg="[filebeat] Starting (exec driver)" 
time="2017-11-23T17:31:29+08:00" level=info msg="[filebeat] Configuration change detected, rewriting configuration file." 
time="2017-11-23T17:31:30+08:00" level=info msg="[filebeat] Stopping" 
time="2017-11-23T17:31:33+08:00" level=info msg="[filebeat] Starting (exec driver)"

However i didn’t get any message, so i check out the logs of Filebeat, and i find connect was refused

2017-11-23T17:31:34+08:00 INFO Home path: [C:\Program Files\graylog\collector-sidecar] Config path: [C:\Program Files\graylog\collector-sidecar] Data path: [C:\Program Files\graylog\collector-sidecar\cache\filebeat\data] Logs path: [C:\Program Files\graylog\collector-sidecar\logs]
2017-11-23T17:31:34+08:00 INFO Setup Beat: filebeat; Version: 5.5.1
2017-11-23T17:31:34+08:00 INFO Max Retries set to: 3
2017-11-23T17:31:34+08:00 INFO Activated logstash as output plugin.
2017-11-23T17:31:34+08:00 INFO Publisher name: PC-DUYUCONG
2017-11-23T17:31:34+08:00 INFO Flush Interval set to: 1s
2017-11-23T17:31:34+08:00 INFO Max Bulk Size set to: 2048
2017-11-23T17:31:34+08:00 ERR Not loading modules. Module directory not found: C:\Program Files\graylog\collector-sidecar\module
2017-11-23T17:31:34+08:00 INFO filebeat start running.
2017-11-23T17:31:34+08:00 INFO Registry file set to: C:\Program Files\graylog\collector-sidecar\cache\filebeat\data\registry
2017-11-23T17:31:34+08:00 INFO Loading registrar data from C:\Program Files\graylog\collector-sidecar\cache\filebeat\data\registry
2017-11-23T17:31:34+08:00 INFO States Loaded from registrar: 4
2017-11-23T17:31:34+08:00 INFO Loading Prospectors: 1
2017-11-23T17:31:34+08:00 INFO Start sending events to output
2017-11-23T17:31:34+08:00 INFO Starting Registrar
2017-11-23T17:31:34+08:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
2017-11-23T17:31:34+08:00 INFO Prospector with previous states loaded: 4
2017-11-23T17:31:34+08:00 INFO Starting prospector of type: log; id: 11968943014683501787 
2017-11-23T17:31:34+08:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1
2017-11-23T17:31:44+08:00 INFO Harvester started for file: D:\Program Files (x86)\iVMS8600-TOCC\log\cms\info.log
2017-11-23T17:31:44+08:00 INFO Harvester started for file: D:\Program Files (x86)\iVMS8600-TOCC\log\cms\debug.log
2017-11-23T17:31:44+08:00 INFO Harvester started for file: D:\Program Files (x86)\iVMS8600-TOCC\log\cms\error.log
2017-11-23T17:31:46+08:00 ERR Connecting error publishing events (retrying): dial tcp [::1]:5044: connectex: No connection could be made because the target machine actively refused it.
2017-11-23T17:31:49+08:00 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: connectex: No connection could be made because the target machine actively refused it.
2017-11-23T17:31:53+08:00 ERR Connecting error publishing events (retrying): dial tcp [::1]:5044: connectex: No connection could be made because the target machine actively refused it.
2017-11-23T17:31:59+08:00 ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: connectex: No connection could be made because the target machine actively refused it.

So what could lead to this and how could to resolved it.

2

Can you see what the Logstash Output section in your filebeat look like?
Is it having a FQDN?
Is the port allowed on the firewall?

3

You mean collector-sidecar’s output? where i could find it. In fact

2017-11-23T17:31:34+08:00 ERR Not loading modules. Module directory not found: C:\Program Files\graylog\collector-sidecar\module

I did’t set any model, is this have some infurence

4

I have closed firewall,and i have configed FQDN in collector_sidecar.yml,but i still refursed by machine

5

You should have a filebeat config file in C:\Program Files\graylog\collector-sidecar\generated folder
Check how does the logstash output look this.

That IP:Port destination should be reachable from your client where Collector sidecar is running.

6

Thanks i find where i misconf. In the Configure Beats Outputs-Hosts i conf
['localhost:5044']
But i should use FQDN in there
Thanks, you help me a lot !!!

7

Ensure that you don’t modify that file.
Instead modify the Beats Output section in your Collector Configuration in UI

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.