OWASP / Honeypot-Project

79 stars 27 forks source link

Logstash Cant communication on 5044: Connection refuse #16

Open Tejpandya opened 3 years ago

Tejpandya commented 3 years ago

Hello,

I've Implemented honeypot project locally . As soon as I trigger mod-sec rule. (by hitting curl request) Python file start processing those rule but, got this error.

ERROR   pipeline/output.go:100  Failed to connect to backoff(async(tcp://127.0.0.1:5044)): dial tcp 127.0.0.1:5044: connect: connection refused
modsec_app    | 2021-01-06T07:49:46.218Z    INFO    pipeline/output.go:93   Attempting to reconnect to backoff(async(tcp://127.0.0.1:5044)) with 3 reconnect attempt(s)

Any thoughts on this ?

my env file

LOGSTASH_HOST=127.0.0.1:5044

my filebeat.yml

output:
  logstash:
    enabled: true
    hosts: '${LOGSTASH_HOST:?must set LOGSTASH_HOST env variable}'
    timeout: 15

filebeat:
  inputs:
    -
      paths:
        - /var/log/modsec_audit_processed.log
      type: log
      json.keys_under_root: true
      json.add_error_key: true

my logstash.conf file

input {
  beats {
    port => 5044
    type => "mod_security"
    codec => json
    ssl => false
  }
}

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
  stdout { codec => rubydebug }
}