IIS logs are not forwarding from azure windows VM to Graylog server

Graylog Central (peer support)
1

Hello, I am trying to forward IIS logs from azure windows VM to graylog but not working as expected.

Azure Linux VM (Debian):

I installed graylog as containers in the azure Linux VM. All containers are working as expected and able to access the graylog UI without any issues.

  1. I added beats input in UI and running on port 5044.
  2. I installed sidecar in azure windows VM and configured. Sidecar service is running without any issues.
  3. Now I’ve assigned the created input to sidecar in graylogUI and I have noticed that the sidecar status changed to running state and at the same time I have noticed that service with winlogbeats is running in azure windows VM which means graylog sidecar and garylog winlogbeats services are running in windows VM but not able to see any logs flowing from windows azure VM to graylog.

I noticed the following error in winlogbeatlog file. I confused that whether the graylog server rejecting or the azure vm is failing to send. Note that garylog url is accessible in this azure windows VM with 9000 port.

Graylog VM and windows AM both are in same VNET

{“log.level”:“error”,“@timestamp”:“2025-07-17T14:03:34.099+0200”,“log.logger”:“publisher_pipeline_output”,“log.origin”:{“file.name”:“pipeline/client_worker.go”,“file.line”:148},“message”:“Failed to connect to backoff(async(tcp://we-graylog.co.nm:5044)): dial tcp 10.33.6.11:5044: connectex: No connection could be made because the target machine actively refused it.”,“service.name”:“winlogbeat”,“ecs.version”:“1.6.0”}

here is the beats input configuration details:

Global inputs 1 configured
IIS logs from windows server Beats (6878e5b4d0ffecfa8b4e2844)
1 SETUP
bind_address: 0.0.0.0
charset_name: UTF-8
no_beats_prefix: true
number_worker_threads: 4
override_source:
port: 5044
recv_buffer_size: 1048576
tcp_keepalive: false
tls_cert_file:
tls_client_auth: disabled
tls_client_auth_cert_file:
tls_enable: false
tls_key_file:
tls_key_password: ********

Pleas help me to resolve this issue.

2

Hey @I_am_winner

Have you tried testing with tcpdump between you shipper and GrayLog
Only things i can think of are:

  • Not listening on 0.0.0.0:5044 (or the IP 10.33.6.11)
  • The input is stopped or misconfigured
  • A local or network firewall is blocking the port
3

How can I check the input is running or stopped. I didn’t get any status for input but I can see the sidecar status as running in graylog UI.

BTW the tcpdump need to execute on graylog server or windows server?

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.