# Elasticsearch unreachable from Logstash

**URL:** <https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698>\
**Category:** Elasticsearch\
**Created:** [September 24, 2018, 3:14pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698 "2018-09-24T15:14:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![raphael\_d](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@raphael\_d](https://discuss.elastic.co/u/raphael_d)\
**Post date:** [September 24, 2018, 3:14pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698/1 "2018-09-24T15:14:47Z")

</div>

Hello everyone,  
I have searched for a long time for a solutios, but found none yet.

When I run Logstash to connect to Elasticsearch through the local network, it is not working. I get the following message:  
`Sep 24 12:59:37 elasticsearch1 logstash[28554]: [2018-09-24T12:59:37,507] [WARN] [logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://192.168.144.163:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://192.168.144.163:9200/][Manticore::SocketException] Connection refused (Connection refused)"}`

here is my logstash configuration file:

```
input {
  beats {
    port => 5044
  }
}

filter {
}

output {
  elasticsearch {
    hosts => ["192.168.144.163:9200"] 
  }
}

```

I let elasticsearch.yml without changing anything. If I try to put the change suggested in [this thread](https://discuss.elastic.co/t/elasticsearch-unreachable-error-in-logstash/75157/8), I get the following message: `Caused by: java.lang.IllegalArgumentException: unknown setting [xpack.monitoring.elasticsearch.url] please check that any required plugins are installed, or check the breaking changes documentation for removed settings`

Note that tcpdump in the Elasticsearch machine shows connection attempts from the Logstash machine.

How can I make Logstash and Elasticsearch work together?

Thank you for your answers

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [September 24, 2018, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698/2 "2018-09-24T15:55:49Z")

</div>

You may want to try to set the `network.host` setting in elasticsearch.yml

[https://www.elastic.co/guide/en/elasticsearch/reference/current/network.host.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/network.host.html)

---

<div class="post-metadata">

**Author:** ![raphael\_d](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@raphael\_d](https://discuss.elastic.co/u/raphael_d)\
**Post date:** [September 25, 2018, 8:21am UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698/3 "2018-09-25T08:21:38Z")

</div>

It worked, thanks. Then I had to modify vm.max\_map\_count and max file descriptors using:

- [https://www.elastic.co/guide/en/elasticsearch/reference/current/setting-system-settings.html#limits.conf](https://www.elastic.co/guide/en/elasticsearch/reference/current/setting-system-settings.html#limits.conf)
- [https://github.com/docker-library/elasticsearch/issues/111](https://github.com/docker-library/elasticsearch/issues/111)

since this solution automatically made elasticsearch go in production mode

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2018, 8:21am UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-logstash/149698/4 "2018-10-23T08:21:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.