Attempted to resurrect connection to dead ES instance in secure ELK

[kiran80511 (kiran kumari)]

Hi,
I am using version 7.14 for elasticsearch, logstash and kibana .
In logstash log I got this error:

Sep 01 10:43:09 elastic.sys logstash[2975]: [2021-09-01T10:43:09,352][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://logstash_writer:xxxxxx@elastic.sys:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://logstash_writer:xxxxxx@elastic.sys:9200/][Manticore::SocketException] Connection refused (Connection refused)"}

This is my conf file

input {
udp {
port => 5044
type => "syslog"
}
}
output {
  elasticsearch {
ilm_enabled => false
    hosts => ["https://elastic.sys:9200"]
    cacert => "/etc/logstash/certs/ca.crt"
    user => "logstash_writer"
    password => "QGqqEqLxtCfA1OsZgYQA"
      index => "syslog"
}
  stdout { codec => rubydebug }
}

Please help

[warkolm (Mark Walkom)]

@kiran80511

Connection refused

Can you curl elastic.sys:9200 from the Logstash host?

[kiran80511 (kiran kumari)]

Hello sir,

This is the output

[root@elastic ~]# curl -XGET https://logstash_writer:QGqqEqLxtCfA1OsZgYQA@elastic.sys:9200/
{
  "name" : "elastic",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "f1L8GhrxQdehL2gS0JksDQ",
  "version" : {
    "number" : "7.14.0",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "dd5a0a2acaa2045ff9624f3729fc8a6f40835aa1",
    "build_date" : "2021-07-29T20:49:32.864135063Z",
    "build_snapshot" : false,
    "lucene_version" : "8.9.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}