# Attempted to send a bulk request to Elasticsearch configured at '\["http://localhost:9200"\]', but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Connexion refusée",

**URL:** <https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359>\
**Category:** Logstash\
**Created:** [September 23, 2016, 10:08am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359 "2016-09-23T10:08:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Izana](https://avatars.discourse-cdn.com/v4/letter/i/bc79bd/32.png) [@Izana](https://discuss.elastic.co/u/Izana)\
**Post date:** [September 23, 2016, 10:08am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359/1 "2016-09-23T10:08:03Z")

</div>

Hello everyone,

I am a beginner on ELK. I apologize first for my bad English, I'm French.

I have 2 different error messages when launching the command "./logstash windows.conf -f".

The first being:  
{Connection refused: class =\> "Manticore SocketException ::": level =\>: error}

The second being:  
Attempted to send a request to bulk Elasticsearch configured at ["http: // localhost: 9200"] 'goal Elasticsearch Appears to be unreachable or down! {: Error\_message =\> "Connection refused": class =\> "Manticore SocketException ::": level =\>: error}

Here's my conf NXLOG on my Windows client:

> define ROOT C:\Program Files (x86)\nxlog

> Moduledir %ROOT%\modules  
> CacheDir %ROOT%\data  
> Pidfile %ROOT%\data\nxlog.pid  
> SpoolDir %ROOT%\data  
> LogFile %ROOT%\data\nxlog.log

> Module xm\_syslog Module xm\_json

> Module im\_msvistalog Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to\_json(); # For windows 2003 and earlier use the following: # Module im\_mseventlog

> Module om\_tcp Host 192.168.1.1 Port 3515

> \<Route 1\>  
> Path in =\> out

Here's my conf windows.conf I run with Logstash:

> input {
> 
> # Accept messages in on tcp/3515
> 
> # Incoming messages will be in json format, one per line
> 
> # Tag these messages as windows and eventlog so we can filter on them later on
> 
> tcp {  
> port =\> 3515
> 
> # codec =\> json\_lines { charset =\> CP1252 }
> 
> codec =\> "line"  
> tags =\> ["windows","eventlog"]  
> type =\> "WindowsEventLog"  
> }  
> }  
> filter{  
> if [type] == "WindowsEventLog" {  
> json{  
> source =\> "message"  
> }  
> if [SourceModuleName] == "eventlog" {  
> mutate {  
> replace =\> ["message", "%{Message}"]  
> }  
> mutate {  
> remove\_field =\> ["Message"]  
> }  
> }  
> }  
> }

Here specifically the progress of the command:  
./logstash -f windows.conf

> Settings: Default pipeline workers: 1  
> Connexion refusée {:class=\>"Manticore::SocketException", :level=\>:error}  
> Pipeline main started  
> ....  
> Received an event that has a different character encoding than you configured. {:text=\>"{\"EventTime\":\"2016-09-23 11:42:41\",\"Hostname\":\"L  
> ...  
> at [Source: [B@595f8dc3; line: 1, column: 3]\>, :level=\>:warn}  
> Attempted to send a bulk request to Elasticsearch configured at '["[http://localhost:9200](http://localhost:9200)"]', but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Connexion refusée", :class=\>"Manticore::SocketException", :level=\>:error}  
> Attempted to send a bulk request to Elasticsearch configured at '["[http://localhost:9200](http://localhost:9200)"]', but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Connexion refusée", :class=\>"Manticore::SocketException", :level=\>:error}

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 23, 2016, 10:37am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359/2 "2016-09-23T10:37:24Z")

</div>

As the error message says, Elasticsearch appears to be unreachable or down. Is Elasticsearch running at all? On which host? Which port? Could a firewall be blocking the access?

---

<div class="post-metadata">

**Author:** ![Izana](https://avatars.discourse-cdn.com/v4/letter/i/bc79bd/32.png) [@Izana](https://discuss.elastic.co/u/Izana)\
**Post date:** [October 3, 2016, 12:38pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359/3 "2016-10-03T12:38:57Z")

</div>

Hello,

I apologize for the delay in replying.

ElasticSearch appears to be launched, however I can not run it as logstash in "init.d" because I simply unzip but I tested it by the command "./elasticsearch" which no returns me error.

ElasticSearch is on the same machine as logstash and its port is the default, the 9200 I think.

Regarding the firewall, I do not see how the firewall blocks, if so, what port would be blocked?

Thank you for your answer.

Have a good day.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at-http-localhost-9200-but-elasticsearch-appears-to-be-unreachable-or-down-error-message-connexion-refusee/61359/4 "2017-07-06T04:36:05Z")

</div>