# After install watcher logstash cannot join the cluster
**URL:** https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 2, 2015, 3:03pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744 "2015-06-02T15:03:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@ourlord](https://discuss.elastic.co/u/ourlord)
#### Post date: [June 2, 2015, 3:03pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744/1 "2015-06-02T15:03:55Z")
Hello good people,
I have 3 nodes cluster and 2 logstash instance use `elasticsearch` `node` output. After installing watcher for all 3 nodes, the logstash instances repeatedly showing the following warning and cannot do anything more.
```
WARN: org.elasticsearch.transport.netty: [logstash- ******* 5-6181-2044] Message not fully read (request) for [4860] and action [discovery/zen/join/validate], resetting
INFO: org.elasticsearch.discovery.zen: [logstash-*******5-6181-2044] failed to send join request to master [[********5][YdGHuHyFTWiHNunW1QusOQ][********5][inet[/***. ***.***.**5:9300]]{master=true}], reason [org.elasticsearch.transport.RemoteTransportException: [*********5][inet[/ ***.***. ***.** 5:9300]][discovery/zen/join]; org.elasticsearch.transport.RemoteTransportException: [logstash-*********5-6181-2044][inet[/***. ***.***.**5:9301]][discovery/zen/join/validate]; org.elasticsearch.ElasticsearchIllegalArgumentException: No custom index metadata factory registered for type [licenses]]
```
I can see something wrong with the license, might be related to installing `elasticsearch/license/latest`. I think I can resolve this by uninstalling the license plugin but I cannot test watcher in this case. And in order to let logstash functional normally I might change to `elasticsearch-http` output for a while.
Any idea about this?
Thanks a lot!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 3, 2015, 12:25pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744/2 "2015-06-03T12:25:05Z")
The elasticsearch-http output is deprecated, use the elasticsearch output with the http protocol.
However this is interesting, I will ask one of the watcher dev team to take a look 🙂
---
### Author:  [@jordansissel](https://discuss.elastic.co/u/jordansissel)
#### Post date: [June 3, 2015, 6:49pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744/3 "2015-06-03T18:49:17Z")
This seems to be an error because Logstash attempts to join the cluster with a NodeClient and fails because it doesn't have the Elasticsearch license plugin installed.
Possible workarounds include not using the default protocol (node), and using either transport or http:
```auto
output {
elasticsearch {
protocol => http
...
}
}
```
---
### Author:  [@ourlord](https://discuss.elastic.co/u/ourlord)
#### Post date: [June 3, 2015, 10:37pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744/4 "2015-06-03T22:37:05Z")
Yeah, I am already using the `http` protocol in `elasticsearch` output to let Logstash functional normally. However, this would stop me monitoring the health of Logstash instances by Node Stats API.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/after-install-watcher-logstash-cannot-join-the-cluster/1744/5 "2017-07-06T13:49:42Z")