Filebeat 连接 Logstash 常见问题。

1. Failed to connect to backoff(async(tcp://ip:5044)): dial tcp ip:5044: i/o timeout
2. Failed to connect to backoff(async(tcp://ip:5044)): dial tcp ip:5044: connect: connection refused
3. Failed to publish events caused by: write tcp ip:46890->ip:5044: write: connection reset by peer
4. Filebeat error: lumberjack protocol error and Logstash error: OPENSSL_internal:WRONG_VERSION_NUMBER

解决方法， 参考我在 StackOverflow 上的 回答

附上最终的配置，详情 回答

logstash conf file /etc/logstash/conf.d/beat.conf

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    ssl_verify_mode => "peer"
  }
}

output {
  elasticsearch {
    hosts => "http://127.0.0.1:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

filebeat conf file /etc/filebeat/filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /data/error_logs/Log_error_201908


#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["example.com:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

  # Certificate for SSL client authentication
  ssl.certificate: "/etc/pki/tls/certs/logstash-forwarder.crt"

  # Client Certificate Key
  ssl.key: "/etc/pki/tls/private/logstash-forwarder.key"