Communication filebeat to Logstash not working

[Rawane]

Filbeat not send data to logstash because it show this error:
[publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(async(tcp://logstash-archimedlog.dev.k8s.recouv:443)) established
Failed to publish events caused by: lumberjack protocol error
Failed to publish events caused by: client is not connected

see my conf filebeat:
hosts: ["logstash-archimedlog.dev.k8s.recouv:443"]
ssl.certificate_authorities: ["cerrr.crt"]
see my cong logstash :
BeatsInputPipeline.conf
input {
beats {
id => "BeatsInput"
port => 5044
host => "0.0.0.0"
include_codec_tag => true
}
kubernate /ingress map 443 to port 5044.

[cwiechmann]

Hi @Rawane,

Please change your Filebeat configuration from:
hosts: ["logstash-archimedlog.dev.k8s.recouv:443"]
to:
hosts: ["logstash-archimedlog.dev.k8s.recouv:5044"]

Cheers,
Chris

[Rawane]

Port 5044 is internal in kubernate, it is mapped by the 443 from where the configuration hosts: ["logstash-archimedlog.dev.k8s.recouv:443"].
see configuration ingress:
Ports
80, 443
TLS
logstash-archimedlog-secret

Rules
Host: logstash-archimedlog.dev.k8s.recouv
Path
Backends
/
axway-elk-apim4elastic-logstash:5044

I specify that Logstash, Elastic, Kibana run in kubernate while Filbeat run on another environment.
Test Filebeat ouput elasticsearch work well.
output.elasticsearch:

Array of hosts to connect to.

hosts: ["elastic-archimedlog.dev.k8s.recouv:443"]
ssl.certificate_authorities: ["certificat_v2.crt"]

[cwiechmann]

Filebeat to LogStash us using the Lumberjack protocol. Hence, you cannot use an Ingress-Resource that very likely provision an Application-Load-Balancer for HTTP-Traffic.

You either need to use a Network Load-Balancer or a Nodeport.

[Rawane]

Thanks,
its works for me.