Port 5044 – Logstash Beats

TCP

Port 5044 is the default Logstash port for the Beats input plugin. Filebeat, Metricbeat, Packetbeat, and other Elastic Beats agents ship logs and metrics to Logstash on port 5044. It uses the Lumberjack protocol with TLS. In the ELK stack, the flow is: Beats → Logstash (5044) → Elasticsearch (9200) → Kibana (5601).

Port Number

5044

Protocol

TCP

Service

Elastic Beats Input

Range

IANA Registered (1024–49151)

Description

Logstash's Beats input listens on port 5044 for connections from Elastic Beats agents. The Lumberjack protocol provides back-pressure to prevent Beats from overwhelming Logstash. TLS should be configured on port 5044 to encrypt log data in transit. Port 5044 only needs to be accessible from hosts running Beats agents – never from the public internet.

Security risks

1CVE-2021-22138: Logstash Beats input TLS bypass – certain client certificate configurations allowed connection without valid cert (fixed 7.12.1)
2Default Beats input has no authentication – any client that can reach port 5044 can inject arbitrary log data into the pipeline
3Log injection attacks: attacker sends crafted log entries that trigger false alerts, pollute dashboards, or exploit log processing pipelines (e.g., Log4j patterns in log content)
4Without TLS, log data (which often contains PII, tokens, and internal IPs) is transmitted in cleartext – passive interception on the network exposes everything
5Backpressure handling: overwhelming port 5044 with data can cause Logstash to drop legitimate logs, creating monitoring blind spots during an attack

Firewall guidance

Allow inbound 5044 only from known Beat agent IPs/subnets. In cloud environments, use security groups scoped to the VPC CIDR. Always enable TLS (ssl => true in logstash input config) with mutual TLS (client certificate verification) for production. Consider running Elastic Agent with Fleet Server instead of raw Beats for centralized enrollment and auth.

Diagnosis commands

Test if Logstash Beats input is accepting connections (will show connected or refused)

shell

curl -v --connect-timeout 3 telnet://localhost:5044

Verify Logstash is listening on 5044 and check which process

shell

ss -tlnp | grep 5044

Test Filebeat connectivity to Logstash (run on agent machine)

shell

filebeat test output -c /etc/filebeat/filebeat.yml

Check Logstash logs for Beats input errors or TLS issues

shell

cat /var/log/logstash/logstash-plain.log | grep -i 'beats\|5044\|ssl'

Usage examples

Port 5044 – Logstash Beats

shell

filebeat -e -c filebeat.yml
nc -zv logstash.example.com 5044

Common services on this port

LogstashElastic AgentFilebeatMetricbeatHeartbeatPacketbeatWinlogbeat

Related ports

9200

Elasticsearch HTTP API

5601

Kibana UI

9300

Elasticsearch transport (inter-node)

5045

Logstash Beats TLS (common alternate)

History

The Beats protocol was introduced by Elastic in 2015 with Filebeat and the Lumberjack protocol (v1/v2). Port 5044 was chosen as the default for Logstash's Beats input plugin. The protocol is a simple binary framing format optimized for log shipping with backpressure (Filebeat pauses when Logstash is overwhelmed). Elastic Agent (2020) consolidates all Beats into a single agent managed by Fleet Server.

FAQ

Filebeat vs Elastic Agent?

Filebeat: single-purpose log shipper, simple configuration, low resource usage, ships to Logstash (5044) or Elasticsearch directly. Elastic Agent: unified agent replacing all Beats, centrally managed via Fleet Server, handles logs + metrics + security + APM, supports integrations. Use Elastic Agent for new deployments; Filebeat for minimal footprint or when you only need log collection.

How do I enable TLS on the Beats input?

In logstash.conf: input { beats { port => 5044, ssl => true, ssl_certificate => '/path/server.crt', ssl_key => '/path/server.key', ssl_certificate_authorities => ['/path/ca.crt'], ssl_verify_mode => 'force_peer' } }. On Filebeat: output.logstash: hosts: ['logstash:5044'], ssl.certificate_authorities: ['/path/ca.crt'], ssl.certificate: '/path/client.crt', ssl.key: '/path/client.key'.