Logstash Cant communication on 5044: Connection refuse
Opened this issue · 0 comments
Tejpandya commented
Hello,
I've Implemented honeypot project locally .
As soon as I trigger mod-sec rule. (by hitting curl request)
Python file start processing those rule but,
got this error.
ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://127.0.0.1:5044)): dial tcp 127.0.0.1:5044: connect: connection refused
modsec_app | 2021-01-06T07:49:46.218Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(async(tcp://127.0.0.1:5044)) with 3 reconnect attempt(s)
Any thoughts on this ?
my env file
LOGSTASH_HOST=127.0.0.1:5044
my filebeat.yml
output:
logstash:
enabled: true
hosts: '${LOGSTASH_HOST:?must set LOGSTASH_HOST env variable}'
timeout: 15
filebeat:
inputs:
-
paths:
- /var/log/modsec_audit_processed.log
type: log
json.keys_under_root: true
json.add_error_key: true
my logstash.conf file
input {
beats {
port => 5044
type => "mod_security"
codec => json
ssl => false
}
}
output {
elasticsearch {
hosts => "elasticsearch:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
stdout { codec => rubydebug }
}