How to configure filebeat and logstash? 3 VMs

Question

I have 3 VMs and I would like to install logstash locally and filebeat in each VM. I installed filebeat and my filebeat.yml is

filebeat.prospectors:
- input_type: log
paths:
- /path/*.xml
# scan_frequency: 60s
document_type: message
multiline.pattern: '^<measInfo'
multiline.negate: true
multiline.match: after
output.logstash:
    hosts:["my_ip_address:5044"]

I did the same thing for 2 others VM My logstash.conf (running locally) is:

input{
    beats{
    port=>5044
    host=>"ip_address_of_VM"
}}

I run logstash locally and then the filebeat in the VM1 but I get this message error:

Failed to connect: dial tcp my_ip_address:5044: getsockopt: connection refused

It's the correct way? and how I can resolve this problem?

C.med C.med · Accepted Answer · 2018-07-19T14:23:05

Solved: 
input{
    beats{
    port=>5044
    #host=>"ip_address_of_VM"
}}

Filebeat is running on the VM so the output was the ip of my local machine. But the host( look at my input) of logstash was the ip of the VM. So I just changed the host of logstash and now he is running locally.

How to configure filebeat and logstash? 3 VMs

1 Answers