Elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error

My Logstash can not connect to Elastic Search.

My Logstash beats.conf config

input {
  beats {
    port => 5044
  }
}
output {
  elasticsearch { hosts => ["18.00.00.00:9200"] }
  stdout { codec => rubydebug }
}

My Filebeats Config

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["3.00.00.00.00:5044"]

My Elastic Search config

# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 0.0.0.0
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["logstash public ip"]

Current my logstash error when I run "bin/logstash -f beats.conf"

[INFO ] 2022-11-07 06:13:32.665 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, "pipeline.sources"=>["/usr/share/logstash/beats.conf"], :thread=>"#<Thread:0x2148efd4 run>"}
[INFO ] 2022-11-07 06:13:33.251 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>0.58}
[INFO ] 2022-11-07 06:13:33.274 [[main]-pipeline-manager] beats - Starting input listener {:address=>"0.0.0.0:5044"}
[INFO ] 2022-11-07 06:13:33.288 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[INFO ] 2022-11-07 06:13:33.373 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2022-11-07 06:13:33.438 [[main]<beats] Server - Starting server on port: 5044
[INFO ] 2022-11-07 06:13:37.589 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=>"18.139.158.62:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: 18.139.158.62:9200 failed to respond>}
[WARN ] 2022-11-07 06:13:37.590 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://18.139.158.62:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://18.139.158.62:9200/][Manticore::ClientProtocolException] 18.139.158.62:9200 failed to respond"}
[INFO ] 2022-11-07 06:13:42.598 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=>"18.139.158.62:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: 18.139.158.62:9200 failed to respond>}
[WARN ] 2022-11-07 06:13:42.599 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://18.139.158.62:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://18.139.158.62:9200/][Manticore::ClientProtocolException] 18.139.158.62:9200 failed to respond"}
[INFO ] 2022-11-07 06:13:47.606 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=>"18.139.158.62:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: 18.139.158.62:9200 failed to respond>}
[WARN ] 2022-11-07 06:13:47.607 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://18.139.158.62:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://18.139.158.62:9200/][Manticore::ClientProtocolException] 18.139.158.62:9200 failed to respond"}
[INFO ] 2022-11-07 06:13:52.615 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=>"18.139.158.62:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: 18.139.158.62:9200 failed to respond>}
[WARN ] 2022-11-07 06:13:52.615 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://18.139.158.62:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://18.139.158.62:9200/][Manticore::ClientProtocolException] 18.139.158.62:9200 failed to respond"}
[INFO ] 2022-11-07 06:13:57.623 [Ruby-0-Thread-9: :1] elasticsearch - Failed to perform request {:message=>"18.139.158.62:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: 18.139.158.62:9200 failed to respond>}
[WARN ] 2022-11-07 06:13:57.623 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://18.139.158.62:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://18.139.158.62:9200/][Manticore::ClientProtocolException] 18.139.158.62:9200 failed to respond"}
^C[WARN ] 2022-11-07 06:13:58.041 [SIGINT handler] runner - SIGINT received. Shutting down.
^C[FATAL] 2022-11-07 06:13:58.626 [SIGINT handler] runner - SIGINT received. Terminating immediately..
[ERROR] 2022-11-07 06:13:58.684 [[main]>worker0] javapipeline - Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"main", :error=>"", :exception=>Java::OrgJrubyExceptions::ThreadKill, :backtrace=>[], :thread=>"#<Thread:0x2148efd4 sleep>"}

That is not a valid IP.

Nor is this.

What IP is Elasticsearch actually listening on?

The last one is real public IP of elasticsearch IP and above IPs are just modified security purpose

Is Elasticsearch responding on that IP and port?

I allowed all ports on both Elasticsearch and logstash for both inobound and outbound. How can I check Elastic Search is response on logstash machine?

Curl it :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.