# Data movement is taking place in logstash but we are getting the error

**URL:** <https://discuss.elastic.co/t/data-movement-is-taking-place-in-logstash-but-we-are-getting-the-error/96115>\
**Category:** Logstash\
**Created:** [August 7, 2017, 1:43pm UTC](https://discuss.elastic.co/t/data-movement-is-taking-place-in-logstash-but-we-are-getting-the-error/96115 "2017-08-07T13:43:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JAYALAKSHMI](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@JAYALAKSHMI](https://discuss.elastic.co/u/JAYALAKSHMI)\
**Post date:** [August 7, 2017, 1:43pm UTC](https://discuss.elastic.co/t/data-movement-is-taking-place-in-logstash-but-we-are-getting-the-error/96115/1 "2017-08-07T13:43:11Z")

</div>

Hi All,

We have configured the logstash as below.

input {  
elasticsearch {  
hosts =\> "localhost:9202"  
index =\> "index\_name"  
size =\> 100  
scroll =\> "1m"  
docinfo =\> true  
}  
}

filter {  
mutate {  
remove\_field =\> [“@version”, “@timestamp”]  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9204"  
user =\> "username"  
password =\> "password"  
sniffing =\> true  
index =\> "%{[@metadata][\_index]}"  
document\_type =\> "%{[@metadata][\_type]}"  
document\_id =\> “%{[@metadata][\_id]}”  
}  
}

While executing logstash we could see that the data is moving from the source and destination but getting the below error in the log file.

[2017-08-04T02:54:07,621][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-08-04T02:54:12,572][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), [http://username:xxxxxx@localhost:9284/](http://username:xxxxxx@localhost:9284/)]}}  
[2017-08-04T02:54:12,588][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), :path=\>"/"}  
[2017-08-04T02:54:12,826][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#Java::JavaNet::URI:0xd24bfbb}  
[2017-08-04T02:54:12,826][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://username:xxxxxx@localhost:9284/](http://username:xxxxxx@localhost:9284/), :path=\>"/"}  
[2017-08-04T02:54:13,090][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#Java::JavaNet::URI:0x50ed996}  
[2017-08-04T02:57:13,292][WARN][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out {:url=\>[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), :error\_message=\>“Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out”, :error\_class=\>“LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError”}  
[2017-08-04T02:57:13,296][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch’ but Elasticsearch appears to be unreachable or down! {:error\_message=\>“Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out”, :class=\>“LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError”, :will\_retry\_in\_seconds=\>2}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2017, 1:43pm UTC](https://discuss.elastic.co/t/data-movement-is-taking-place-in-logstash-but-we-are-getting-the-error/96115/2 "2017-09-04T13:43:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.