# Attempted to resurrect connection to dead ES instance - but wrong host?

**URL:** <https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-wrong-host/77282>\
**Category:** Logstash\
**Created:** [March 3, 2017, 8:30am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-wrong-host/77282 "2017-03-03T08:30:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guenther](https://avatars.discourse-cdn.com/v4/letter/g/e36b37/32.png) [@guenther](https://discuss.elastic.co/u/guenther)\
**Post date:** [March 3, 2017, 8:30am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-wrong-host/77282/1 "2017-03-03T08:30:50Z")

</div>

Hi,

we are using logstash (version 5.2.2) and ES (version 5.2.2) in a docker swarm.  
The logstash instance is only for metricbeats and works very well.

```
input {
  beats {
    port => "5044"
  }
}

filter {

}

output {
  elasticsearch {
    hosts => ["es-master-1:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
# stdout {
# codec => "rubydebug"
# }
}

```

As you can clearly see, the host for ES output is `es-master-1` but I get the following error messages:

```
[2017-03-03T09:21:18,787][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-03-03T09:21:18,789][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x1476328f URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-03-03T09:21:23,790][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-03-03T09:21:23,793][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x670dfd9a URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-03-03T09:21:28,794][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-03-03T09:21:28,796][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x4ec6a8f5 URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-03-03T09:21:33,797][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-03-03T09:21:33,799][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x557bdc37 URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}

```

Does logstash try to connect to a local instance?

---

<div class="post-metadata">

**Author:** ![Kent\_Brake](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kent_brake/32/51426_2.png) [@Kent\_Brake](https://discuss.elastic.co/u/Kent_Brake)\
**Post date:** [March 4, 2017, 2:50pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-wrong-host/77282/2 "2017-03-04T14:50:53Z")

</div>

Hi Guether,

If you are using the elastic published docker image, you can override the x-pack logging destination by supplying your [own logstash.yml file](https://www.elastic.co/guide/en/logstash/current/docker.html).

The default settings are [here](http://xpack.monitoring.elasticsearch.url).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2017, 2:51pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-wrong-host/77282/3 "2017-04-01T14:51:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.