winlogbeat : elasticsearch transport on non 9200 port not working

[UnclePhil]

It seems that when i use another port than 9200 in the yml config file, the connection is not established.
i test the 3 following

output:
  elasticsearch:
    hosts: ["elasticsearch.irisnet.be"]
    index: "winlogbeat"

this is defaulting to 9200 and work perfectly (but 9200 is not a standard port allowed in our Firewall)

output:
  elasticsearch:
    hosts: ["elasticsearch.irisnet.be:9200"]
    index: "winlogbeat"

is working correctly

output:
  elasticsearch:
    hosts: ["elasticsearch.irisnet.be:80"]
    index: "winlogbeat"

is giving the following in the log file

2016-02-04T13:28:00+01:00 INFO GeoIP disabled: No paths were set under output.geoip.paths
2016-02-04T13:28:00+01:00 INFO Activated elasticsearch as output plugin.
2016-02-04T13:28:00+01:00 INFO Publisher name: SVIMSCAVW001
2016-02-04T13:28:00+01:00 INFO Flush Interval set to: 1s
2016-02-04T13:28:00+01:00 INFO Max Bulk Size set to: 50
2016-02-04T13:28:00+01:00 INFO Init Beat: winlogbeat; Version: 1.1.0
2016-02-04T13:28:00+01:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat\.winlogbeat.yml
2016-02-04T13:28:00+01:00 INFO winlogbeat sucessfully setup. Start running.
2016-02-04T13:28:00+01:00 INFO Connecting error publishing events (retrying): 503 Service Unavailable
2016-02-04T13:28:00+01:00 INFO send fail
2016-02-04T13:28:00+01:00 INFO backoff retry: 1s
2016-02-04T13:28:01+01:00 INFO Connecting error publishing events (retrying): 503 Service Unavailable

BTW: the service is perfectly reachable from the same machine on port 80, because i have powershell script working on this port to the same destination

best regards,
Ph Koenig

[ruflin]

I tested this briefly locally with a random port (9999) on OS X and in general it seems to work as expected. Can you enabled debug mode by running it with -e -d "*" to get some more information?

[urso]

Please use discuss.elastic.co for these kind of questions.

See logs showing 503 being returned by server or firewall. Check HEAD request to elasticsearch.irisnet.be:80 being supported.