### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [May 30, 2025, 5:23am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/1 "2025-05-30T05:23:06Z")
Hi All,
I am working on a project to spin up ELK stack inside docker container. I have containers for elasticsearch/kibana up and running but whenever I am trying to run logstash it gives me the below error,
I replaced IP address with a "\*",
```auto
[2025-05-30T05:08:16,184][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"*:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#}
[2025-05-30T05:08:16,184][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://*:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http:/*:9200/][Manticore::ClientProtocolException] *:9200 failed to respond"}
```
Now, to address this problem I tried to modify xpack.security.enabled to false, but on doing that it makes kibana inaccessible. 9200 port is open as per the output of netstat command as per below.
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:5601 0.0.0.0:\* LISTEN 7208/docker-proxy
tcp 0 0 0.0.0.0:9200 0.0.0.0:\* LISTEN 8610/docker-proxy
tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 1093/sshd: /usr/sbi
tcp6 0 0 :::5601 :::\* LISTEN 7215/docker-proxy
tcp6 0 0 :::9200 :::\* LISTEN 8617/docker-proxy
tcp6 0 0 :::22 :::\* LISTEN 1093/sshd: /usr/sbi
udp 0 0 127.0.0.1:323 0.0.0.0:\* 675/chronyd
udp6 0 0 ::1:323 :::\*
Can anyone please suggest what's wrong here ?
Thanks.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 30, 2025, 6:15am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/2 "2025-05-30T06:15:14Z")
Hi @piyush_hn Welcome to the community.
You'll need to share your docker compose.
Are all three in the same compose?
Please include the versions etc
Most likely elasticsearch is running on https..
So the logstash connection will need to be https
Then you will either need to use the CA for SSL verification or disable SSL verification.
Share your compose.
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [May 30, 2025, 3:09pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/3 "2025-05-30T15:09:44Z")
Hello Stephen,
I am running commands via CLI not by docker compose. Should I share the commands ?
Thanks,
Piyush
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 30, 2025, 3:32pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/4 "2025-05-30T15:32:21Z")
Did you address look at
> Most likely elasticsearch is running on https..
>
> So the logstash connection will need to be https
>
> Then you will either need to use the CA for SSL verification or disable SSL verification.
And do you understand docker networking?
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [May 30, 2025, 3:53pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/5 "2025-05-30T15:53:24Z")
So, Elasticsearch on docker is running on http only. It's not on https.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 30, 2025, 4:54pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/6 "2025-05-30T16:54:47Z")
Can you curl the Elasticsearch endpoint from inside the logstash container? or from your host?
From inside container try this (using what you are using will probably fail)
`curl -v http://:9200`
Or try this... (probably will work)
`curl -v http://host.docker.internal:9200`
From outside container
`curl -v http://localhost:9200`
Do you know how docker networks ... how to get one container to connect to another
> [@Filebeat Docker - Elasticsearch Host Issue](https://discuss.elastic.co/t/filebeat-docker-elasticsearch-host-issue/320083/2):
>
> Hi @mwsprotte Welcome to the community! Docker Networking Issue not Elastic... Another explanation Might be worth reading... if you are new to docker try using host.docker.internal docker run \ --net=elastic docker.elastic.co/beats/filebeat:7.17.4 \ setup -E setup.kibana.host=host.docker.internal:5601 \ -E output.elasticsearch.hosts=["https://host.docker.internal:9200"]
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [June 4, 2025, 4:04am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/7 "2025-06-04T04:04:32Z")
Hi Stephen,
Please see the below outputs. Elasticsearch is running with HTTP only but still getting same error.
> [2025-06-04T04:54:23,626][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic](http://elastic):xxxxxx@_:9200/", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [http://_:9200/][Manticore::ClientProtocolException] \*:9200 failed to respond"}
Note that "\*" denotes my localhost IP address.
1. Inside docker container ff7d48d43af4,
> [root@ELK-Stack ~]# docker exec -it ff7d48d43af4 bash
> bash-5.1$ curl -v http://\*:9200
>
> - Trying \*:9200...
> - Connected to \* (\*) port 9200 (#0)
>
> > GET / HTTP/1.1
> > Host: \*:9200
> > User-Agent: curl/7.76.1
> > Accept: _/_
>
> - Empty reply from server
> - Closing connection 0
> curl: (52) Empty reply from server
> bash-5.1$ exit
> exit
1. Directly on the docker host,
> [root@ELK-Stack ~]# curl -v [http://localhost:9200](http://localhost:9200)
>
> - Trying ::1:9200...
> - Connected to localhost (::1) port 9200 (#0)
>
> > GET / HTTP/1.1
> > Host: localhost:9200
> > User-Agent: curl/7.76.1
> > Accept: _/_
>
> - Empty reply from server
> - Closing connection 0
> curl: (52) Empty reply from server
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 4, 2025, 5:36am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/8 "2025-06-04T05:36:37Z")
> [@piyush\_hn](#):
>
> Elasticsearch is running with HTTP only but still getting same error.
Are you sure..
> [@piyush\_hn](#):
>
> Closing connection 0
> curl: (52) Empty reply from server
Did you do a Google search on that almost always means you are sending an HTTP request to HTTPS server
Try
`curl -k -v https://localhost:9200`
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [June 9, 2025, 6:29am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/9 "2025-06-09T06:29:53Z")
Hi Stephen,
Apologies for responding late here, please check the below output. If you check the last line I am seeing an authentication error. So is this due to an HTTP request sent to HTTPS server ? What should be the solution to that ?
```auto
bash-5.1$ curl -k -v https://*:9200
* Trying *:9200...
* Connected to * (*) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: CN=e9981ef695a5
* start date: May 29 03:15:08 2025 GMT
* expire date: May 29 03:15:08 2027 GMT
* issuer: CN=Elasticsearch security auto-configuration HTTP CA
* SSL certificate verify result: self-signed certificate in certificate chain (19), continuing anyway.
* TLSv1.2 (OUT), TLS header, Unknown (23):
> GET / HTTP/1.1
> Host: *:9200
> User-Agent: curl/7.76.1
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Unknown (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: Basic realm="security", charset="UTF-8"
< WWW-Authenticate: Bearer realm="security"
< WWW-Authenticate: ApiKey
< content-type: application/json
< content-length: 461
<
* Connection #0 to host * left intact
> {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 9, 2025, 12:41pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/10 "2025-06-09T12:41:43Z")
Right so elasticsearch is running on HTTPS And requires authentication.
And the result is 401 unauthorized. Which means you need to provide the username and password In order to connect.
At some point in your setup you should have received or set the elastic user password. That's what you're going to need to connect from logstash to elasticsearch
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [June 9, 2025, 4:19pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/11 "2025-06-09T16:19:42Z")
In order to connect with Elasticsearch, I think logstash.conf file needs to be updated, correct ? I did mention username & password which are correct during installation but could see same error. Is there anything I am missing ?
> [2025-06-09T16:17:21,848][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic](http://elastic):xxxxxx@_:9200/", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [http://_:9200/][Manticore::ClientProtocolException] \*:9200 failed to respond"}
logstash.conf file as follows,
> input {
> tcp {
> port =\> 5044
> codec =\> json
> }
> }
> output {
> elasticsearch {
> hosts =\> ["[http://3.111.196.163:9200](http://3.111.196.163:9200)"]
> index =\> "logs-%{+YYYY.MM.dd}"
> user=\> "elastic"
> password=\> "\*G9P\_lBmdMopTlyFcDO6"
> }
> }
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 9, 2025, 8:32pm UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/12 "2025-06-09T20:32:26Z")
> [@piyush\_hn](#):
>
> hosts =\> ["[http://3.111.196.163:9200](http://3.111.196.163:9200)"]
As just described above not `http`
`https` \<\<\<\<\<\ ["https://3.111.196.163:9200"]`
^^^^^^ THIS
Also you SSL cert does not have that IP as a SAN or IP so it will fail verification
So will need to either fix your cert... This is general SSL cert stuff you need to learn about that but in the meantime you can turn off verification omode
> **[Elasticsearch output plugin | Elastic Documentation](https://www.elastic.co/docs/reference/logstash/plugins/plugins-outputs-elasticsearch#plugins-outputs-elasticsearch-ssl_verification_mode)**
>
> Plugin version: v12.0.3, Released on: 2025-04-17, Changelog. For other versions, see the Versioned plugin docs. For questions about the plugin, open a...
`ssl_verification_mode => "none" `
```auto
output {
elasticsearch {
hosts => ["https://3.111.196.163:9200"]
index => "logs-%{+YYYY.MM.dd}"
ssl_verification_mode => "none"
user=> "elastic"
password=> "*G9P_lBmdMopTlyFcDO6"
}
```
---
### Author:  [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)
#### Post date: [June 10, 2025, 6:07am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721/13 "2025-06-10T06:07:18Z")
Thanks Stephen for your help, I will refer to the documentation as you mentioned.