After installing X-pack, logstash can't run

[f26227279 (張皓翔)]

As title, after I install x-pack, logstash can't run.
and it show me some errors:
28,006][WARN ][logstash.licensechecker.licensereader] UNEXPECTED POOL ERROR {:e=>#<LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError: No Available connections>}
[2018-01-06T21:55:28,006][ERROR][logstash.licensechecker.licensemanager] Unable to retrieve license information from license server {:message=>"No Available connections", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError"}
[2018-01-06T21:55:28,006][WARN ][logstash.licensechecker.xpackinfo] Nil response from License Server
[2018-01-06T21:55:28,743][INFO ][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2018-01-06T21:55:28,758][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_system:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused: connect"}

input{
tcp{
	host => "120.127.XXX.XX"
	port => 5510
	codec => json
	type =>"ntopng-*"
	
}
}
filter{
	if[type]=="ntopng-*"
	{
		if "" not in [IPV4_SRC_ADDR] and "" not in [IPV6_SRC_ADDR]
		{
			drop{}
		}
	}
}
output{
elasticsearch {
            codec => "json" 
            hosts => ["120.127.XXX.XX:9200"]
			user => elastic
			password => SNOOPY255262
			sniffing => false
    }
if[type]=="ntopng-*"
{
	stdout{codec=> rubydebug}
}
}

thank you in advance!

[magnusbaeck (Magnus Bäck)]

As the error message says, Logstash can't connect to localhost:9200. So is ES running? Is it listening on the loopback interface? Port 9200? Should it even be connecting to localhost:9200 given that you have 120.127.XXX.XX:9200 in your Logstash output configuration?

elasticsearch {
codec => "json"

Unrelated to your problem, but drop the codec option.

[f26227279 (張皓翔)]

I am running elasticsearch on 120.127.XXX.XX:9200
but I don't know where the logstash.yml could edit the logstash output.

[warkolm (Mark Walkom)]

Did you install X-Pack for Elasticsearch as well?

[f26227279 (張皓翔)]

yes, both have installed x-pack