Why does filebeat try to connect to elasticseach?

0
votes

When running filebeat I get the below error:

2019-03-04T14:39:49.704Z INFO cfgfile/reload.go:205 Loading of config files completed. 2019-03-04T14:39:50.709Z INFO pipeline/output.go:95 Connecting to backoff(elasticsearch(http://localhost:9200)) 2019-03-04T14:39:54.240Z ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://localhost:9200)): Get http://localhost:9200: dial tcp [::1]:9200: connectex: No connection could be made because the target machine actively refused it.

Which is really weird, because my filebeat is not configured to connect to elastic search:

(filebeat.config)

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\my_Logs\*



output.logstash:
  hosts: ["localhost:5044"]

I cannot understand why this is happening, none of the tutorials I've followed mention elasticseach as a requirement, nor do any of the sample config files show anyone configuring the location.

Why is this happening and how can I disable this functionality?

1
logstashelastic-stackfilebeat

1 Answers

2
votes

The reason could very well be that your filebeat instance is not loading the config that you think it is.

The default filebeat.yml has these lines:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

Please check your config file.

Update: Additionally, filebeat has a command line option that allows you export the current configuration. This can be useful if you are uncertain what config it sees:

sudo filebeat export config

Link to the current docs: https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html#export-command