# Can't connect to ElasticSearch after X-pack install
**URL:** https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062
**Category:** Logstash
**Created:** [February 8, 2018, 2:07pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062 "2018-02-08T14:07:40Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 8, 2018, 2:07pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/1 "2018-02-08T14:07:40Z")
Hello. I just follow steps to configure x-pack with Logstash ([Installing X-pack In Logsatsh])([Installing X-Pack in Logstash | Logstash Reference [6.2] | Elastic](https://www.elastic.co/guide/en/logstash/6.2/installing-xpack-log.html))
But after this, my logstash pipeline doesn't work anymore ..
Here it is my logstash.yml :
> path.data: /var/lib/logstash
> path.logs: /var/log/logstash
> xpack.monitoring.elasticsearch.username: logstash\_system
> xpack.monitoring.elasticsearch.password: mypass
Here it is my output pipeline :
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> user =\> logstash\_system
> password =\> mypass
> }
> stdout { codec =\> rubydebug }
> }
and here the mistakes that I have :
> **[INFO]** 2018-02-08 15:01:10.290 [Ruby-0-Thread-10: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:228] licensereader - Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"}
> **[WARN]** 2018-02-08 15:01:10.297 [Ruby-0-Thread-10: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:228] licensereader - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"**Got response code '401' contacting Elasticsearch at URL '[http://localhost:9200/](http://localhost:9200/)'"}**
> **[ERROR]** 2018-02-08 15:01:11.436 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 29, column 23 (byte 680) after output {\n elasticsearch { \n hosts =\> ["localhost:9200"]\n user =\> logstash\_system\n password =\> Azerty5", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:105:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:18:in `interval'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
What cause this issue ?
thx !
---
### Author:  [@jpcarey](https://discuss.elastic.co/u/jpcarey)
#### Post date: [February 8, 2018, 2:32pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/2 "2018-02-08T14:32:02Z")
401 unauthorized. Did you setup the user / password for writing the monitoring data? This is done in the logstash.yml file
It is also complaining about an invalid config, at line 29 column 23. I couldn’t spot the issue from the truncated config provided, you need to fully check that the config is formed correctly.
Also I see you configured the elasticsearch output in your pipeline to use logstash\_system. This user is meant for writing monitoring data, and does not have the necessary permissions to create other data. These docs describe setting up an appropriate logstash\_writer user:
[https://www.elastic.co/guide/en/logstash/current/ls-security.html](https://www.elastic.co/guide/en/logstash/current/ls-security.html)
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 8, 2018, 2:56pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/3 "2018-02-08T14:56:33Z")
Ok, I just created the user "logstash\_internal" with the role "logstash\_writer" exactly as indicated in your link (by changing the password of course :))
I modified logstash.yml which now becomes :
> path.data: /var/lib/logstash
> path.logs: /var/log/logstash
> xpack.monitoring.elasticsearch.username: logstash\_internal
> xpack.monitoring.elasticsearch.password: newpass
And I also changed my pipeline which now becomes:
> input {
> udp {
> port =\> 514
> type =\> syslog
> }
> }
>
> #### FILTER SECTION
>
> filter {
> if [type] == "syslog" {
> grok {
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
> add\_field =\> ["received\_at", "%{@timestamp}"]
> add\_field =\> ["received\_from", "%{host}"]
> }
>
> ```
> date {
> match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
>
> ```
>
> }
> }
>
> #### OUTPUT SECTION
>
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> user =\> "logstash\_internal"
> password =\> "newpass"
> }
> stdout { codec =\> rubydebug }
> }
I always have the same mistake, couldn't contact, error 401. BUT the [ERROR] about invalid config had disappear
---
### Author:  [@jpcarey](https://discuss.elastic.co/u/jpcarey)
#### Post date: [February 8, 2018, 3:30pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/4 "2018-02-08T15:30:38Z")
I assume you the logstash.yml is setup correctly as well for publishing the
monitoring data?
[https://www.elastic.co/guide/en/logstash/current/configuring-logstash.html](https://www.elastic.co/guide/en/logstash/current/configuring-logstash.html)
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 8, 2018, 3:36pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/5 "2018-02-08T15:36:37Z")
I've no configure logstash.yml for monitoring data (your link).
Is it important to do this to solve my issue ?
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 8, 2018, 3:44pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/6 "2018-02-08T15:44:30Z")
So I just configure, juste 1 line needs to be add.
So now, logstash.yml :
Always same issue.
PS : 'the q in the first line is not in the config file, just mistake at screen moment'
---
### Author:  [@jpcarey](https://discuss.elastic.co/u/jpcarey)
#### Post date: [February 9, 2018, 2:37am UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/7 "2018-02-09T02:37:06Z")
So what is the current error with those two items now fixed?
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 9, 2018, 7:15am UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/8 "2018-02-09T07:15:04Z")
**So, the current error is :**
I'll let you take a look at my pipeline, my logstash.yml and the user created :
**logstash.yml :**
**The pipeline :**
**The logstash\_internal user :**
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 9, 2018, 2:57pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/9 "2018-02-09T14:57:53Z")
Anyone can help me ? ☹
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2018, 2:57pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-after-x-pack-install/119062/10 "2018-03-09T14:57:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.