# After installing X-pack, logstash can't run

**URL:** <https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377>\
**Category:** Logstash\
**Created:** [January 6, 2018, 2:36pm UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377 "2018-01-06T14:36:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [January 6, 2018, 2:36pm UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/1 "2018-01-06T14:36:48Z")

</div>

As title, after I install x-pack, logstash can't run.  
and it show me some errors:  
28,006][WARN][logstash.licensechecker.licensereader] UNEXPECTED POOL ERROR {:e=\>#\<LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError: No Available connections\>}  
[2018-01-06T21:55:28,006][ERROR][logstash.licensechecker.licensemanager] Unable to retrieve license information from license server {:message=\>"No Available connections", :class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError"}  
[2018-01-06T21:55:28,006][WARN][logstash.licensechecker.xpackinfo] Nil response from License Server  
[2018-01-06T21:55:28,743][INFO][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2018-01-06T21:55:28,758][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused: connect"}

```
input{
tcp{
	host => "120.127.XXX.XX"
	port => 5510
	codec => json
	type =>"ntopng-*"
	
}
}
filter{
	if[type]=="ntopng-*"
	{
		if "" not in [IPV4_SRC_ADDR] and "" not in [IPV6_SRC_ADDR]
		{
			drop{}
		}
	}
}
output{
elasticsearch {
            codec => "json" 
            hosts => ["120.127.XXX.XX:9200"]
			user => elastic
			password => SNOOPY255262
			sniffing => false
    }
if[type]=="ntopng-*"
{
	stdout{codec=> rubydebug}
}
}

```

thank you in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 6, 2018, 4:33pm UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/2 "2018-01-06T16:33:18Z")

</div>

As the error message says, Logstash can't connect to localhost:9200. So is ES running? Is it listening on the loopback interface? Port 9200? Should it even be connecting to localhost:9200 given that you have 120.127.XXX.XX:9200 in your Logstash output configuration?

> elasticsearch {  
> codec =\> "json"

Unrelated to your problem, but drop the `codec` option.

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [January 7, 2018, 2:13am UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/3 "2018-01-07T02:13:46Z")

</div>

I am running elasticsearch on 120.127.XXX.XX:9200  
but I don't know where the logstash.yml could edit the logstash output.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2018, 4:16am UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/4 "2018-01-07T04:16:23Z")

</div>

Did you install X-Pack for Elasticsearch as well?

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [January 7, 2018, 10:17am UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/5 "2018-01-07T10:17:35Z")

</div>

yes, both have installed x-pack

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2018, 10:17am UTC](https://discuss.elastic.co/t/after-installing-x-pack-logstash-cant-run/114377/6 "2018-02-04T10:17:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.