# Docker Logstash to Elastic: connection refused

**URL:** <https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583>\
**Category:** Logstash\
**Created:** [June 12, 2018, 6:20pm UTC](https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583 "2018-06-12T18:20:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adrien\_Renaud](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@Adrien\_Renaud](https://discuss.elastic.co/u/Adrien_Renaud)\
**Post date:** [June 12, 2018, 6:20pm UTC](https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583/1 "2018-06-12T18:20:45Z")

</div>

I use the following official dockers:

```
docker run -d -p 9200:9200 -p 9300:9300 --name myel \
            -e "discovery.type=single-node" \
            -e "XPACK_SECURITY_ENABLED=false" \
            -e "XPACK_REPORTING_ENABLED=false" \
            -e "XPACK_MONITORING_ENABLED=false" \
            docker.elastic.co/elasticsearch/elasticsearch:6.2.3

docker run --name logstash --rm \
        -v $PWD/data:/usr/tmp \
        -v $PWD/logstash_confs/:/usr/share/logstash/pipeline/ \
        -e "ELASTIC_HOST=localhost:9200" \
        -e "XPACK_SECURITY_ENABLED=false" \
        -e "XPACK_REPORTING_ENABLED=false" \
        -e "XPACK_MONITORING_ENABLED=false" \
        docker.elastic.co/logstash/logstash:6.2.3

```

And there is my logstash conf:

```
input {
    file {
        path => "/usr/tmp/ts_indicator_description.csv"
        start_position => "beginning"
        sincedb_path => "/dev/null"
    }
}

filter {
  csv {
    separator => ","
    #autodetect_column_names => "true"
    columns => ['indicator_name', 'indicator_description']
    skip_header => "true"
  }
}

output {
  elasticsearch {
    hosts => "${ELASTIC_HOST}"
    user => ""
    password => ""
    index => "ts_indicator_description"
  }
  #stdout { codec => rubydebug }
}

```

But I'm getting this explicit error message:  
`[2018-06-12T18:13:37,724][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}`

And indeed login to the logstash container:

```
$ sudo docker exec -it mylo bash
bash-4.2$ curl -X GET localhost:9200
curl: (7) Failed connect to localhost:9200; Connection refused

```

But from the host, `curl -X GET localhost:9200` is giving me the now famous **"You know, for search"**

Can we solve this?

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [June 12, 2018, 9:51pm UTC](https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583/2 "2018-06-12T21:51:26Z")

</div>

Try adding a `--net="host"` to your docker run arguments.

```auto
docker run --net="host" --name logstash --rm \
        -v $PWD/data:/usr/tmp \
        -v $PWD/logstash_confs/:/usr/share/logstash/pipeline/ \
        -e "ELASTIC_HOST=localhost:9200" \
        -e "XPACK_SECURITY_ENABLED=false" \
        -e "XPACK_REPORTING_ENABLED=false" \
        -e "XPACK_MONITORING_ENABLED=false" \
        docker.elastic.co/logstash/logstash:6.2.3

```

---

<div class="post-metadata">

**Author:** ![Adrien\_Renaud](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@Adrien\_Renaud](https://discuss.elastic.co/u/Adrien_Renaud)\
**Post date:** [June 13, 2018, 10:27am UTC](https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583/3 "2018-06-13T10:27:04Z")

</div>

Thank you very much. Adding `--net=host` did the trick. For posterity, here is my commands to run ELK:

```
docker run --name mylo \
       --net=host\
        -v $PWD/data:/usr/tmp \
        -v $PWD/logstash_confs/:/usr/share/logstash/pipeline/ \
        -e "ELASTIC_HOST=localhost:9200" \
        -e "XPACK_SECURITY_ENABLED=false" \
        -e "XPACK_REPORTING_ENABLED=false" \
        -e "XPACK_MONITORING_ENABLED=false" \
        docker.elastic.co/logstash/logstash:6.2.3

docker run -d -p 9200:9200 -p 9300:9300 --name myel \
                --net=host\
                -e "discovery.type=single-node" \
                -e "XPACK_SECURITY_ENABLED=false" \
                -e "XPACK_REPORTING_ENABLED=false" \
                -e "XPACK_MONITORING_ENABLED=false" \
                docker.elastic.co/elasticsearch/elasticsearch:6.2.3

docker run --name myki -p 5601:5601 -d \
                --net=host \
                -e "ELASTICSEARCH_URL=http://localhost:9200" \
                docker.elastic.co/kibana/kibana:6.2.3
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2018, 10:27am UTC](https://discuss.elastic.co/t/docker-logstash-to-elastic-connection-refused/135583/4 "2018-07-11T10:27:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.