Port 5044Logstash Beats

Default TCP port for Logstash receiving events from Beats such as Filebeat.

transport: tcp
in transit: cleartext
assignment: unofficial
risk: 6/10
lookups: 0

Technical Details

what runs on :5044

This is the Beats/Lumberjack protocol over TCP, using a long-lived connection with framed event batches, protocol negotiation, acknowledgements, and windowing. Logstash's Beats input defaults to port 5044; TLS can be enabled, but traffic is cleartext in the normal default configuration unless SSL/TLS is explicitly configured.

Security Information

exposure of :5044

risk score

6/ 10risk

treat as sensitive. widely scanned and regularly exploited when reachable — restrict it to known sources.

security averages 3.1 across 332 ports — this one sits 2.9 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

An internet-exposed listener may accept forged log or telemetry events if authentication and TLS controls are not configured, and cleartext deployments expose event contents in transit. Restrict it to trusted Beats clients and protect it with network controls and TLS, especially when logs contain credentials, tokens, or personal data.

Record

iana registry entry

port: :5044
service: Logstash Beats
transport: TCP
encryption: cleartext
assignment: convention only
risk: 6/10risk
category: Security System
usage: Logstash commonly listens on TCP port 5044 for Filebeat and other Elastic Beats clients. It is typically used inside a private network or through a controlled network path to collect logs and other telemetry.
lookups: 0rank 994
added: 2026-09-18
updated: 2026-09-18
references: Elastic Logstash Beats input plugin

Something wrong?

This record is maintained by the engineers who use port 5044. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-09-18.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 332 in security →

the 8 most looked-up other ports in security — 332 ports carry that label.

port	service	proto	category	risk	views
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:443	HTTPS	TCPtls	Web Services	caution	65.9k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Squid Proxy HTTP	TCP	Web Services	caution	45.8k
:8080	HTTP Alternate	TCPtls	Web Services	caution	44.9k
:7000	Vuze HTTPS Tracker	TCPtls	Security	caution	28.9k

risk mix of the 8 listed

caution100%

3 of 8 encrypted

Port :5044Logstash Beats

Technical Details

Security Information

Related Ports

Port 5044Logstash Beats