: Failed to
establish a new connection: [Errno 111] Connection refused)
```
I also tried connecting on 9200 using no SSL and that gives the same Connection refused errors.
EDIT: my key has that name based on a guide I was using, but I'm using Beats and winlogbeat to ship log files.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:30pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/4 "2017-01-06T17:30:28Z")
How is Elasticsearch secured? Is it secured with X-Pack or something else?
Are you using the same certificate (which I find highly unlikely)? What do the Elasticsearch logs say when you try to connect?
What do you see if you run `curl -XGET http://server.domain.local:9200`? what about `curl -XGET https://server.domain.local:9200` (please substitute the appropriate IP if necessary)
When I hit localhost:
```auto
$ curl -XGET http://127.0.0.1:9200
{
"name" : "NO479iq",
"cluster_name" : "untergeek-test",
"cluster_uuid" : "2I-CSpkcQ-iU56pSgu6wWg",
"version" : {
"number" : "5.1.1",
"build_hash" : "5395e21",
"build_date" : "2016-12-06T12:36:15.409Z",
"build_snapshot" : false,
"lucene_version" : "6.3.0"
},
"tagline" : "You Know, for Search"
}
```
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:33pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/5 "2017-01-06T17:33:08Z")
> [@MSAdmin](#):
>
> I'm using Beats and winlogbeat to ship log files.
What does your Elasticsearch output block look like in your winlogbeat.yml file? That will indicate whether SSL is involved, and what we're up against.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:33pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/6 "2017-01-06T17:33:16Z")
> [@theuntergeek](#):
>
> curl -XGET [http://server.domain.local:9200](http://server.domain.local:9200)
Apparently I have 9200 completely locked down. Even from localhost I can't get anything on 9200.
[This was the guide](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04#install-nginx) I used when setting everything up. So, I'm using nginx to secure it.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:34pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/7 "2017-01-06T17:34:36Z")
Elasticsearch is commented out in my winlogbeat.yml file. Under logstash I have:
```
output.logstash:
# The Logstash hosts
hosts: ["garcia.magicsprings.local:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
ssl.certificate_authorities: ["C:\\logstash-forwarder.crt"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
```
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:34pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/8 "2017-01-06T17:34:37Z")
With that guide, you wouldn't have an SSL certificate, but you probably have authentication credentials. That would mean using the `http_auth: "user:pass"` line in the curator.yml file.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:35pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/9 "2017-01-06T17:35:18Z")
What does your Elasticsearch output block look like in your Logstash configuration file, then?
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:36pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/10 "2017-01-06T17:36:51Z")
In my Logstash config file I have:
```
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
```
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:38pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/11 "2017-01-06T17:38:32Z")
That's the input block. I need to see the output block, the one that sends data to Elasticsearch.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:39pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/12 "2017-01-06T17:39:21Z")
Sorry
```
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:42pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/13 "2017-01-06T17:42:08Z")
I'm looking over that guide, and the proxy isn't to secure Elasticsearch, but Kibana. Elasticsearch is not behind anything. If you can't reach Elasticsearch on port 9200, then something else is wrong.
What do you see if you try: `curl -XGET http://127.0.0.1:9200`? If you see nothing, what server is it on? You'll need the appropriate IP address, as those `.local` domain names will not work.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:43pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/14 "2017-01-06T17:43:45Z")
I get
```
curl: (7) Failed to connect to 127.0.0.1 port 9200: Connection refused
```
It also fails with localhost. So something I setup is locking down the ports, just not exactly sure what.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:46pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/15 "2017-01-06T17:46:44Z")
> [@theuntergeek](#):
>
> curl -XGET [http://127.0.0.1:9200](http://127.0.0.1:9200)
OK... I feel real stupid now. The elasticsearch service had crashed. Just restarted it and everything is working now.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [January 6, 2017, 5:48pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/16 "2017-01-06T17:48:37Z")
You don't need `use_ssl: True` in Curator. Just use `hosts: 127.0.0.1` with `port: 9200`, or blank. No need to specify a certificate either.
---
### Author:  [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)
#### Post date: [January 6, 2017, 5:52pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/17 "2017-01-06T17:52:31Z")
Thank you for taking a look at it. Can't believe I didn't check the services first.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 3, 2017, 5:52pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800/18 "2017-02-03T17:52:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.