# Enabling X-Pack in Logstash 7 gives me this error **URL:** \ **Category:** Logstash\ **Created:** [April 12, 2019, 4:30pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671 "2019-04-12T16:30:22Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 4:30pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/1 "2019-04-12T16:30:22Z")
I have a single node ELK 7 stack and I want Kibana to display Logstash in Monitoring. I enabled X-Pack in /etc/logstash/logstash.yml and restart logstash. I see this in /var/log: > Apr 12 11:21:28 nocptc-elk logstash: [2019-04-12T11:21:28,313][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=\>"Elasticsearch Unreachable: [[https://logstash\_system:xxxxxx@10.XX.XX.222:9200/](https://logstash_system:xxxxxx@10.XX.XX.222:9200/)][Manticore::SocketException] Connection refused (Connection refused)"} > Apr 12 11:21:28 nocptc-elk logstash: [2019-04-12T11:21:28,348][ERROR][logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster. Later on I see this error: > pr 12 11:25:28 nocptc-elk logstash: [2019-04-12T11:25:28,331][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=\>"No Available connections"} My logstash.yml is: > path.data: /var/lib/logstash > path.logs: /var/log/logstash > xpack.monitoring.enabled: true > xpack.monitoring.elasticsearch.username: logstash\_system > xpack.monitoring.elasticsearch.password: password > xpack.monitoring.elasticsearch.hosts: ["[https://10.XX.XX.222:9200](https://10.XX.XX.222:9200)"] What can I do to troubleshoot this error? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 12, 2019, 4:37pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/2 "2019-04-12T16:37:07Z")
> [@teamg](#): > > [[https://logstash\_system:xxxxxx@10.XX.XX.222:9200/](https://logstash_system:xxxxxx@10.XX.XX.222:9200/)][Manticore::SocketException] Connection refused (Connection refused)"} That's telling you that it cannot connect. Is elasticsearch running? Verify with "netstat -a | grep 9200" that something is listening to 9200 on that address. If you are binding elasticsearch to 0.0.0.0 then try changing it to the explicit 10.XX.XX.XX address. ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 5:18pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/3 "2019-04-12T17:18:49Z")
> [@Badger](#): > > netstat -a | grep 9200 Nothing is listening but elasticsearch is running: [root@elk ~]# netstat -a | grep 9200 [root@elk ~]# systemctl status elasticsearch > ● elasticsearch.service - Elasticsearch > Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) > Active: active (running) since Fri 2019-04-12 11:18:25 CDT; 59min ago > Docs: [http://www.elastic.co](http://www.elastic.co) > Main PID: 48488 (java) > CGroup: /system.slice/elasticsearch.service > ├─48488 /usr/share/elasticsearch/jdk/bin/java -Xms16g -Xmx16g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyO... > └─48586 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86\_64/bin/controller > > Apr 12 11:18:25 [xx.com](http://xx.com) systemd[1]: Started Elasticsearch. > Apr 12 11:18:25xx.com elasticsearch[48488]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 a...release. > Hint: Some lines were ellipsized, use -l to show in full. ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 5:24pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/4 "2019-04-12T17:24:13Z")
Here's the contents of elasticsearch.yml. Again, this is a single node installation. > path.data: /var/lib/elasticsearch > path.logs: /var/log/elasticsearch ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 12, 2019, 5:44pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/5 "2019-04-12T17:44:03Z")
Elasticsearch binds to localhost by default, so I am not surprised that 10.x.x.x address does not work. But it should still show up as listening on the port. Is there anything relavent in the elasticsearch logs? ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 5:50pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/6 "2019-04-12T17:50:08Z")
In elasticsearch.log I see: > [2019-04-12T11:18:36,786][INFO][o.e.c.s.ClusterSettings] [elk] updating [xpack.monitoring.collection.enabled] from [false] to [true] That's about it. ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 5:52pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/7 "2019-04-12T17:52:31Z")
In /var/log/messages still this: > Apr 12 12:51:05 elk logstash: [2019-04-12T12:51:05,909][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=\>"No Available connections"} ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 12, 2019, 6:07pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/8 "2019-04-12T18:07:48Z")
I fixed it by commenting out the following in /etc/logstash/logstash.yml and restarting logstash: > path.data: /var/lib/logstash > path.logs: /var/log/logstash > xpack.monitoring.enabled: true > xpack.monitoring.elasticsearch.username: logstash\_system > xpack.monitoring.elasticsearch.password: password > #xpack.monitoring.elasticsearch.hosts: ["[https://10.XX.XX.222:9200](https://10.XX.XX.222:9200)"] Logstash now appears in Stack Monitoring on Kibana. Thank you for the support Badger. Your last entry clued me into what could be the problem. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 12, 2019, 7:03pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/9 "2019-04-12T19:03:00Z")
Does 'netstat -an | grep 9200' find it? Maybe the elasticsearch install updates the services database. ---
**Author:** ![teamg](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@teamg](https://discuss.elastic.co/u/teamg)\ **Post date:** [April 15, 2019, 2:21pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/10 "2019-04-15T14:21:53Z")
> [@Badger](#): > > netstat -an | grep 9200 Yes it does: > [root@elk ~]# netstat -an | grep 9200 > tcp 0 0 127.0.0.1:34274 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34302 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34496 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34500 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34296 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34268 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34300 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34314 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34304 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34294 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34292 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34330 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34310 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34298 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34288 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34282 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34494 127.0.0.1:9200 ESTABLISHED > tcp 0 0 127.0.0.1:34306 127.0.0.1:9200 ESTABLISHED > Truncated ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 13, 2019, 2:21pm UTC](https://discuss.elastic.co/t/enabling-x-pack-in-logstash-7-gives-me-this-error/176671/11 "2019-05-13T14:21:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.