# Erro ao executar o logstash

**URL:** <https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664>\
**Category:** Logstash\
**Created:** [August 11, 2023, 9:21pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664 "2023-08-11T21:21:06Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 11, 2023, 9:21pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/1 "2023-08-11T21:21:06Z")

</div>

This error persists and I don't know how to solve it anymore. Can someone help me. Follow my .conf files

input {  
file {  
path =\> "C:/Elastic/logstash-8.9.0/config/logs.log"  
start\_position =\> "beginning"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message}" }  
}  
}

output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "logall12"  
user =\> "elastic"  
password =\> "my pass"  
}  
stdout {  
codec =\> rubydebug  
}  
}

outgoing message  
'  
[2023-08-11T18:12:35,716][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond\>}  
[2023-08-11T18:12:35,717]  
[WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [August 11, 2023, 9:44pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/2 "2023-08-11T21:44:08Z")

</div>

Is ES up and running? Is port 9200 opened on firewall?  
Are you using http or https?  
What is setting for `network.host` in elasticsearch.yml? Try with `network.host: 0.0.0.0`

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 11, 2023, 9:48pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/3 "2023-08-11T21:48:55Z")

</div>

Yes it is running and so is Kibana;  
{  
"name" : "myname",  
"cluster\_name" : "elasticsearch",  
"cluster\_uuid" : "CmAuozqtSLi6buf-i-IXlQ",  
"version" : {  
"number" : "8.8.2",  
"build\_flavor" : "default",  
"build\_type" : "zip",  
"build\_hash" : "98e1271edf932a480e4262a471281f1ee295ce6b",  
"build\_date" : "2023-06-26T05:16:16.196344851Z",  
"build\_snapshot" : false,  
"lucene\_version" : "9.6.0",  
"minimum\_wire\_compatibility\_version" : "7.17.0",  
"minimum\_index\_compatibility\_version" : "7.0.0"  
},  
"tagline" : "You Know, for Search"  
}

Menssage:

[2023-08-11T18:49:19,241][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond\>}  
[2023-08-11T18:49:19,243][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 11, 2023, 10:23pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/4 "2023-08-11T22:23:09Z")

</div>

Can you share your `elasticsearch.yml` file?

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 12, 2023, 1:04am UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/5 "2023-08-12T01:04:16Z")

</div>

Thank you for your attention. Follow the file.

# 

# ---------------------------------- Cluster -----------------------------------

# 

# Use a descriptive name for your cluster:

#cluster.name: my-application

# 

# ------------------------------------ Node ------------------------------------

# 

# Use a descriptive name for the node:

#node.name: node-1

# Add custom attributes to the node:

# 

#node.attr.rack: r1

# 

# ----------------------------------- Paths ------------------------------------

# Path to directory where to store the data (separate multiple locations by comma):

#path.data: /path/to/data

# Path to log files:

# 

#path.logs: /path/to/logs

# 

# ----------------------------------- Memory -----------------------------------

# 

# Lock the memory on startup:

# 

#bootstrap.memory\_lock: true

# 

# ---------------------------------- Network -----------------------------------

# 

#network.host: 192.168.0.1  
network.host: 0.0.0.0

# 

http.port: 9200

# 

# 

# --------------------------------- Discovery ----------------------------------

# 

discovery.seed\_hosts: ["[http://localhost:9200](http://localhost:9200)", "0.0.0.0" ]

# 

# ---------------------------------- Various -----------------------------------

# 

# Allow wildcard deletion of indices:

# 

#action.destructive\_requires\_name: false

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------

# 

# The following settings, TLS certificates, and keys have been automatically

# generated to configure Elasticsearch security features on 19-07-2023 16:25:23

# 

# --------------------------------------------------------------------------------

# Enable security features

xpack.security.enabled: true  
xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents

xpack.security.http.ssl:  
enabled: true  
keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes

xpack.security.transport.ssl:  
enabled: true  
verification\_mode: certificate  
keystore.path: certs/transport.p12  
truststore.path: certs/transport.p12

# Create a new cluster with the current node only

# Additional nodes can still join the cluster later

cluster.initial\_master\_nodes: ["PROGRA02"]

# Allow HTTP API connections from anywhere

# Connections are encrypted and require user authentication

http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere

# Connections are encrypted and mutually authenticated

#transport.host: 0.0.0.0

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [August 12, 2023, 8:16am UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/6 "2023-08-12T08:16:07Z")

</div>

Please use \< /\> icon for formatting.  
Change to HTTPS in the output

```auto
hosts => ["https://localhost:9200"]
ssl => true
cacert => "/path/to/http_ca.crt"
ssl_verify_mode => "none" # or full

```

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 12, 2023, 9:19pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/8 "2023-08-12T21:19:03Z")

</div>

Sorry for the formatting... but it didn't work, the error persists:

My elasticsearch.yml:

```auto
# ---------------------------------- Cluster -----------------------------------
# Use a descriptive name for your cluster:
#cluster.name: my-application
# ------------------------------------ Node ------------------------------------
#node.name: node-1
#node.attr.rack: r1
# ----------------------------------- Paths ------------------------------------
# Path to directory where to store the data (separate multiple locations by comma):
#path.data: /path/to/data
# Path to log files:
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
# Lock the memory on startup:
#bootstrap.memory_lock: true
# ---------------------------------- Network -----------------------------------
network.host: 0.0.0.0
http.port: 9200
# --------------------------------- Discovery ----------------------------------
discovery.seed_hosts: ["https://localhost:9200"]
# ---------------------------------- Various -----------------------------------
#action.destructive_requires_name: false

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically      
# generated to configure Elasticsearch security features on 19-07-2023 16:25:23
#
# --------------------------------------------------------------------------------

# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: none
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["PROGRA02"]
http.host: 0.0.0.0
transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

```

The Logstash:

```auto
[2023-08-12T18:12:07,692][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond>}
[2023-08-12T18:12:07,693]
[WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [August 12, 2023, 10:20pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/9 "2023-08-12T22:20:25Z")

</div>

What you set in output?

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 12, 2023, 11:32pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/10 "2023-08-12T23:32:57Z")

</div>

logstash output?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 13, 2023, 2:23am UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/11 "2023-08-13T02:23:17Z")

</div>

> [@Gustavo](#):
>
> ```auto
> xpack.security.http.ssl:
> enabled: true
> keystore.path: certs/http.p12
> 
> ```

You have `xpack.security.http.ssl.enabled` set to `true`, so your logstash output needs to **https** , not **http**.

> [@Gustavo](#):
>
> `"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"`

Your Logstash output is still using **http** , you need to change it to https and configure the `cacert` option as mentioned on a previous answer.

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 14, 2023, 5:23pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/12 "2023-08-14T17:23:59Z")

</div>

Thanks for the answer; but errors persist.  
my logstahs output:

```auto
input {
  file {
    path => "C:/Elastic/logstash-8.9.0/config/logs.log"
    start_position => "beginning"
  }
}

filter {
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message}" }
  }
}

output {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    index => "logall"
    user => "elastic"
    password => "my pass"
  }
  stdout {
    codec => rubydebug
  }
}

```

my test:

C:\Elastic\logstash-8.9.0\bin\>logstash --config.test\_and\_exit -f C:\Elastic\logstash-8.9.0\config\logstash.conf  
Configuration OK  
[2023-08-14T14:12:49,643][INFO][logstash.runner] Using config.test\_and\_exit mode. Config Validation Result: OK. Exiting Logstash

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 14, 2023, 5:25pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/13 "2023-08-14T17:25:08Z")

</div>

C:\Elastic\logstash-8.9.0\bin\>logstash -f C:\Elastic\logstash-8.9.0\config\logstash.conf  
[2023-08-14T14:23:04,902][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::JavaxNetSsl::SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target\>}

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 14, 2023, 5:51pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/14 "2023-08-14T17:51:17Z")

</div>

> [@Gustavo](#):
>
> [2023-08-14T14:23:04,902][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::JavaxNetSsl::SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target\>}

This is a different error, it is related to the certificate.

As mentioned in [previous answers](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/6) you need to configure the path for the certificate authority you used with the `cacert` option.

Your `elasticsearch` output does not have the `cacert` option configured.

---

<div class="post-metadata">

**Author:** ![Gustavo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gustavo/32/79962_2.png) [@Gustavo](https://discuss.elastic.co/u/Gustavo)\
**Post date:** [August 14, 2023, 6:09pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/15 "2023-08-14T18:09:33Z")

</div>

Obrigado Leandro pela ajuda. Estamos desistindo do projeto. Vamos partir para o Mongodb.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 14, 2023, 6:24pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/16 "2023-08-14T18:24:15Z")

</div>

Tranquilo, mas como mencionado os erros que você recebeu foram devidos a configurações incompletas.

Se no seu caso de uso o MongoDB pode ser uma alternativa, talvez seja melhor usar o Mongo mesmo que tem uma configuração/gestão mais simples, mas embora tanto o Elasticsearch quanto o MongoDB façam a mesma coisa pra alguns casos de uso, nem sempre isso vai ser válido.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2023, 6:30pm UTC](https://discuss.elastic.co/t/erro-ao-executar-o-logstash/340664/18 "2023-09-11T18:30:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.