# Elasticsearch connection refused

**URL:** <https://discuss.elastic.co/t/elasticsearch-connection-refused/67435>\
**Category:** Logstash\
**Created:** [November 29, 2016, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435 "2016-11-29T05:48:24Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![roiyax](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@roiyax](https://discuss.elastic.co/u/roiyax)\
**Post date:** [November 29, 2016, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/1 "2016-11-29T05:48:24Z")

</div>

Hi, I have a problem in my ELK setup with below log messages.

{:timestamp=\>"2016-11-28T21:10:22.958000+1100", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[http://localhost:9200](http://localhost:9200)"]', but Elasticsearch appears to be unreachable or down!", :error\_message=\>"Connection refused (Connection refused)", :class=\>"Manticore::SocketException", :level=\>:error}  
{:timestamp=\>"2016-11-28T21:17:31.787000+1100", :message=\>"SIGTERM received. Shutting down the agent.", :level=\>:warn}  
{:timestamp=\>"2016-11-28T21:17:31.788000+1100", :message=\>"stopping pipeline", :id=\>"main"}  
{:timestamp=\>"2016-11-28T21:17:32.032000+1100", :message=\>"Pipeline main has been shutdown"}  
{:timestamp=\>"2016-11-28T21:37:19.359000+1100", :message=\>"Pipeline main started"}  
{:timestamp=\>"2016-11-28T22:05:15.440000+1100", :message=\>"SIGTERM received. Shutting down the agent.", :level=\>:warn}  
{:timestamp=\>"2016-11-28T22:05:15.443000+1100", :message=\>"stopping pipeline", :id=\>"main"}  
{:timestamp=\>"2016-11-28T22:05:15.977000+1100", :message=\>"Pipeline main has been shutdown"}

need a full understanding of what went wrong with my installation.

Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 29, 2016, 6:02am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/2 "2016-11-29T06:02:26Z")

</div>

> Elasticsearch appears to be unreachable or down!

Most likely the reason.

---

<div class="post-metadata">

**Author:** ![roiyax](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@roiyax](https://discuss.elastic.co/u/roiyax)\
**Post date:** [November 29, 2016, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/3 "2016-11-29T06:10:50Z")

</div>

Hi,

Is there a compatibility issue with the package version ?

am using the following package version.

logstash 2.3  
kibana 4.5  
elasticsearch 2.x  
nginx 1.10  
ubuntu 16.04

Thansk

---

<div class="post-metadata">

**Author:** ![roiyax](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@roiyax](https://discuss.elastic.co/u/roiyax)\
**Post date:** [November 29, 2016, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/4 "2016-11-29T06:20:13Z")

</div>

I have below result when I check the elasticsearch using curl.

curl -4 localhost:9200  
{  
"name" : "Iceman",  
"cluster\_name" : "elasticsearch",  
"cluster\_uuid" : "2W1HX0GST1eBDD1w9-ShPA",  
"version" : {  
"number" : "2.4.2",  
"build\_hash" : "161c65a337d4b422ac0c805f284565cf2014bb84",  
"build\_timestamp" : "2016-11-17T11:51:03Z",  
"build\_snapshot" : false,  
"lucene\_version" : "5.5.2"  
},  
"tagline" : "You Know, for Search"

Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 29, 2016, 6:26am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/5 "2016-11-29T06:26:23Z")

</div>

What is your Logstash config?

---

<div class="post-metadata">

**Author:** ![roiyax](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@roiyax](https://discuss.elastic.co/u/roiyax)\
**Post date:** [November 29, 2016, 7:01am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/6 "2016-11-29T07:01:45Z")

</div>

Hi Dadoonet,

Below is my logstash.conf

input {  
beats {  
port =\> 5044  
ssl =\> true  
#ssl\_certificate =\> "/etc/ssl/logstash-forwarder.crt"  
#ssl\_key =\> "/etc/ssl/logstash-forwarder.key"  
ssl\_certificate =\> "/etc/pki/tls/cert/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
congestion\_threshold =\> "40"  
}  
}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGLINE}" }  
}

```
date {

```

match =\> ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}

}

output {  
elasticsearch {  
hosts =\> localhost  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
}  
stdout {  
codec =\> rubydebug  
}  
}

Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 29, 2016, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/7 "2016-11-29T07:18:49Z")

</div>

Please format your code using `</>` icon. It will make your post more readable.

If you remove the connection to elasticsearch, can you see your lines of logs printed to the console?

I don't see anything obvious from your config here. Moving your question to #logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2016, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-connection-refused/67435/8 "2016-12-27T07:18:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.