No connection could be made because the target machine actively refused it.

[hfariass]

Hi Robert,

I've tried to run 'winlogbeat.exe setup' on Windows 10 & also tried running Filebeat on a Ubiquiti USG but in both instances I receive the following output:
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://192.168.xxx.xxx:9200: Get "https://192.168.xxx.xxx:9200": dial tcp 192.168.xxx.xxx9200: connectex: No connection could be made because the target machine actively refused it.]
I've pointed the output.elasticsearch IP address to my HELK server and I'm still receiving this error. Is there a change to my elasticsearch config file on my HELK server that I need to do? Can you please assist? Any help would be greatly appreciated. Thank you.

[hfariass]

Here is the "elasticsearch.yml" config file. I've changed nothing in this file. The network host is set to accept all traffic.

---------------------------------- Network -----------------------------------

Set the bind address to a specific IP (IPv4 or IPv6):

#network.host: localhost
#network.host: ["localhost", "172.18.0.2"]
network.host: 0.0.0.0

Set a custom port for HTTP:

#http.port: 9200

For more information, consult the network module documentation.

[hfariass]

I've added this to my script and commented out the Elasticsearch output portion of the Winlogbeat.yml file but I'm now receiving another error.
`#-------------------------- Windows Logs To Collect -----------------------------
winlogbeat.event_logs:

• name: Application
  ignore_older: 30m
• name: Security
  ignore_older: 30m
• name: System
  ignore_older: 30m
• name: Microsoft-windows-sysmon/operational
  ignore_older: 30m
• name: Microsoft-windows-PowerShell/Operational
  ignore_older: 30m
  event_id: 4103, 4104
• name: Windows PowerShell
  event_id: 400,600
  ignore_older: 30m
• name: Microsoft-Windows-WMI-Activity/Operational
  event_id: 5857,5858,5859,5860,5861

#----------------------------- Kafka output --------------------------------
output.kafka:

initial brokers for reading cluster metadata

Place your HELK IP(s) here (keep the port).

If you only have one Kafka instance (default for HELK) then remove the 2nd IP that has port 9093

hosts: ["192.168.90.22:9092"]
topic: "winlogbeat"
############################# HELK Optimizing Latency ######################
max_retries: 2
max_message_bytes: 1000000`

"Exiting: Index management requested but the Elasticsearch output is not configured/enabled"

Is there something I'm missing from my winlogbeat.yml config?