I am trying to setup filebeat to logstash and get below errors at filebeat and logstash end:
filebeat; Version: 7.7.0 logstash "number" : "7.8.0"
Modified /etc/filebeat/filebeat.yml:
enabled: true paths: commented output.elasticsearch uncommented output.logstash and added hosts: ["hostname:5044"]
Modified /etc/logstash/conf.d/beats_elasticsearch.conf:
input { beats { port => 5044 } }
#filter { #}
output { elasticsearch { hosts => ["hostname:9200"] } }
I started filebeat and got below error:
2020-07-06T08:51:23.912-0700 ERROR [publisher_pipeline_output] pipeline/output.go:106 Failed to connect to backoff(elasticsearch(http://hostname:5044)): Get http://hostname:5044: dial tcp ip_address:5044: connect: connection refused
Started logstash and its log below:
[INFO ] 2020-07-06 09:00:20.562 [[main]<beats] Server - Starting server on port: 5044
[INFO ] 2020-07-06 09:00:20.835 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-07-06 09:00:45.266 [defaultEventExecutorGroup-4-1] BeatsHandler - [local: x.x.x.x:5044, remote: y.y.y.y:53628] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
[WARN ] 2020-07-06 09:00:45.267 [nioEventLoopGroup-2-2] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
Please explain what else I should do.
Started filebeat and logstash as:
sudo /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml
sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/beats_elasticsearch.conf
Thanks
