# Data from Splunk not reaching Ealsticsearch server through Apache Loadbalancer **URL:** \ **Category:** Elasticsearch\ **Created:** [January 7, 2019, 7:52am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160 "2019-01-07T07:52:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sumith\_naduvath](https://avatars.discourse-cdn.com/v4/letter/s/ad7895/32.png) [@sumith\_naduvath](https://discuss.elastic.co/u/sumith_naduvath)\ **Post date:** [January 7, 2019, 7:52am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/1 "2019-01-07T07:52:21Z")
Hi All, I am trying to setup an Elasticsearch and Kibana on my server and the input data for Elasticsearch is a splunk log forwarder. The splunk is being managed by a third party company and they have configured the log forwarding to my Elasticsearch server on port 9200. However I am not seeing any data on Elasticsearch. Here is how we have configured the Elastic Search. On top, we have a h/w load balancer on which we have configured the public IP (internet facing). From there the request will fwd to webserver(Apache) and below to that we have the application server(elastic). Both Load balancer and Apache are being managed by a different team. Is there any extra configuration required to get the log onto application server? I am able to access Elasticsearch in browser with publicIP:9200 but there is no data being received by elasticsearch. Any insights would be greatly appreciated. Regards, Sumith ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 7, 2019, 8:04am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/2 "2019-01-07T08:04:59Z")
I would be surprised if the Splunk log forwarder supported the Elasticsearch bulk format, so suspect you will need to send this data through Logstash, potentially using a TCP input plugin. ---
**Author:** ![sumith\_naduvath](https://avatars.discourse-cdn.com/v4/letter/s/ad7895/32.png) [@sumith\_naduvath](https://discuss.elastic.co/u/sumith_naduvath)\ **Post date:** [January 7, 2019, 11:07am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/3 "2019-01-07T11:07:26Z")
Hi Christian, Thanks for your update. I tried adding logtash as mentioned. However now the elastic search is failing with below error. _ADMINSHELL_ :/etc/elasticsearch # /etc/init.d/elasticsearch status elasticsearch dead but subsys locked _ADMINSHELL_ :/etc/elasticsearch # To add logstash to the system I am doing the below configuration. Logstash will listen on port 9200 and outputs the result to 9300 which in turn will be used by elasticsearch. # Logstash conf : _ADMINSHELL_ :/usr/share/logstash # cat simple.conf input { tcp { port =\> 9200 } } output { elasticsearch { hosts =\> ["localhost:9300"] } } _ADMINSHELL_ :/usr/share/logstash # # Elasticsearch conf: network.bind\_host: 0.0.0.0 transport.host: localhost transport.tcp.port: 9300 #Set a custom port for HTTP: http.port: 9300 I am not able to make elasticsearch running with port 9300. Also with the above logstash configuration I am not sure what service will be running in port 9200 to scan the incoming logs. Regards, Sumith ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 7, 2019, 11:08am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/4 "2019-01-07T11:08:20Z")
Logstash communicates via HTTP, so you need to use port 9200. ---
**Author:** ![sumith\_naduvath](https://avatars.discourse-cdn.com/v4/letter/s/ad7895/32.png) [@sumith\_naduvath](https://discuss.elastic.co/u/sumith_naduvath)\ **Post date:** [January 7, 2019, 11:21am UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/5 "2019-01-07T11:21:36Z")
Hi Christian, Logstash is configured on port 9200. Since the port is already occupied I have to make elastic search to listen on port 9300. Any issue with this? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 7, 2019, 12:04pm UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/6 "2019-01-07T12:04:47Z")
Do not use port 9200 for the TCP input as this will be misleading. If you do, use e.g. 9201 for the Elasticsearch HTTP port, as it must be different from the transport port. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 4, 2019, 12:04pm UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160/7 "2019-02-04T12:04:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.