# Elasticsearch Cluster not reachable by Logstash
**URL:** https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373
**Category:** Elasticsearch
**Created:** [July 27, 2015, 10:45pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373 "2015-07-27T22:45:40Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 27, 2015, 10:45pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/1 "2015-07-27T22:45:40Z")
Hi,
I am using cluster name in logstash elasticsearch output plugin.
But it is failing to send data to the cluster. Nevertheless, I could reach the server when I specify the hostname.
I would like to know if I have to change something for cluster name to work.
Thanks.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 27, 2015, 11:10pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/2 "2015-07-27T23:10:24Z")
It helps if you paste your config.
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/3 "2015-07-28T16:08:40Z")
Hi @warkolm ,
My config:
```auto
output {
elasticsearch {
#host => "abc.xyz.com"
cluster => "elasticsearch.prod"
protocol => "http"
index => "logstash-%{+YYYY.MM.dd}"
}
}
```
The code works only when I uncomment host line.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 9:41pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/4 "2015-07-28T21:41:18Z")
That's expected, how else will it know where it needs to connect to?
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 9:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/5 "2015-07-28T21:43:27Z")
I thought it would resolve the host names based on the cluster name and connect any one of them.
Isn't it the way?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/6 "2015-07-28T21:45:03Z")
Only with multicast protocols - node or transport.
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 9:46pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/7 "2015-07-28T21:46:58Z")
Okay. Logstash and Elasticsearch combination work any differently if I change to these protocols?
I see that http is generally recommended.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 9:51pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/8 "2015-07-28T21:51:06Z")
No, it'll all work.
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 10:02pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/9 "2015-07-28T22:02:33Z")
I tried reading about the protocols. But not sure I understand when should I use which protocol?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/10 "2015-07-28T22:07:07Z")
[https://www.elastic.co/guide/en/elasticsearch/guide/current/\_transport\_client\_versus\_node\_client.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/_transport_client_versus_node_client.html) may help.
But I find it's easier to just stick with HTTP 🙂
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 11:12pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/11 "2015-07-28T23:12:50Z")
@warkolm
But with HTTP, I am unable to use only cluster name.
Also, I observed one thing though, when I have both cluster name and hostname then even if the elasticsearch host goes down, the logstash still is alive. Can you explain that?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 11:18pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/12 "2015-07-28T23:18:03Z")
If you use HTTP you need to specify the host only, clustername is irrelevant.
If you don't specify any protocol then it uses node by default, and all you need there is the clustername.
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 11:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/13 "2015-07-28T23:22:05Z")
As I understand from the link you shared above, node protocol works when the application is running from one of the Elasticsearch nodes only.
My concern is about a remote server trying to send data to ES using logstash. And don't want to hardcode the hostname, as we might need to bounce it now and then. And Logstash should use other servers in the cluster in that time. Can I do this?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 11:24pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/14 "2015-07-28T23:24:53Z")
Put an ES client node on the LS host, then point LS to localhost is a good idea.
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 11:27pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/15 "2015-07-28T23:27:06Z")
Yeah I thought through this. I don't want anything other than a shipping agent/logstash to work on that remote host. I don't want to maintain ES on the remote.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 28, 2015, 11:28pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/16 "2015-07-28T23:28:22Z")
Specify an array of nodes in the host setting.
Or use a DNS cname that points to multiple end points.
No matter what you chose there is overhead, you cannot get around that 🙂
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 11:29pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/17 "2015-07-28T23:29:56Z")
I can use that I guess and live with the overhead 😉
---
### Author:  [@vilas](https://discuss.elastic.co/u/vilas)
#### Post date: [July 28, 2015, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/18 "2015-07-28T23:34:31Z")
I checked that host setting is a string in Logstash 1.4 and array in 1.5.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:58pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-not-reachable-by-logstash/26373/19 "2017-07-05T23:58:29Z")