elasticsearch - 无法使用 Filebeat 从客户端连接到 Logstash 服务器

Question

我正在尝试启动 filebeat 并将输出发送到 ELK 服务器，但在运行命令时收到以下错误消息/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml

错误信息：

2021-10-18T11:46:18.575Z        ERROR   [logstash]      logstash/async.go:280   Failed to publish events caused by: write tcp 172.31.20.157:48724->MyPublicIP:5044: write: connection reset by peer
2021-10-18T11:46:18.575Z        INFO    [publisher]     pipeline/retry.go:219   retryer: send unwait signal to consumer
2021-10-18T11:46:18.575Z        INFO    [publisher]     pipeline/retry.go:223     done
2021-10-18T11:46:20.215Z        ERROR   [publisher_pipeline_output]     pipeline/output.go:180  failed to publish events: write tcp 172.31.20.157:48724->MyPublicIP:5044: write: connection reset by peer
2021-10-18T11:46:20.215Z        INFO    [publisher_pipeline_output]     pipeline/output.go:143  Connecting to backoff(async(tcp://MyPublicIP:5044))
2021-10-18T11:46:20.215Z        INFO    [publisher]     pipeline/retry.go:219   retryer: send unwait signal to consumer
2021-10-18T11:46:20.215Z        INFO    [publisher]     pipeline/retry.go:223     done
2021-10-18T11:46:20.216Z        INFO    [publisher_pipeline_output]     pipeline/output.go:151  Connection to backoff(async(tcp://MyPublicIP:5044)) established
2021-10-18T11:46:20.273Z        ERROR   [logstash]      logstash/async.go:280   Failed to publish events caused by: write tcp 172.31.20.157:48726->MyPublicIP:5044: write: connection reset by peer

这是 filbeat.yml 配置

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
        hosts: ["MyPublicIP:5044"]

这是 ELK 服务器中的 logstash-sample.conf

input {
  beats {
    port => 5044
    type => "logs"
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
  file {
    path => "/var/log/*.log"
    type => "syslog"
  }
  file {
    path => "/tmp/logstash.txt"

  }
}

output {
  elasticsearch {
    hosts => ["MyPublicIP:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

我可以从 filbeat 客户端服务器远程登录 logstash

[root@ip-172-x-x-x-system]# telnet MyPublicIP 5044
Trying MyPublicIP ...
Connected to MyPublicIP .
Escape character is '^]'.

标签： elasticsearchlogstashfilebeatelk