# Error After updating to ELK 5

**URL:** <https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259>\
**Category:** Logstash\
**Created:** [May 10, 2017, 2:17pm UTC](https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259 "2017-05-10T14:17:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RustuGurkan](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\
**Post date:** [May 10, 2017, 2:17pm UTC](https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259/1 "2017-05-10T14:17:23Z")

</div>

Hi,  
I did a upgrade to ELK 5 but all of the sudden it stopped working

I checked my logs and it says

> `ERR Connecting error publishing events (retrying): dial tcp 192.168.154.100:5044: getsockopt: connection refused`

My config for beats is like this:

> input {  
> beats {  
> port =\> 5044  
> ssl =\> true  
> ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
> ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
> }  
> }

> ```
> #pfSense
> #tcp syslog stream via 5140
> input {
> tcp {
> type => "syslog"
> port => 5140
> }
> }
> #udp syslogs tream via 5140
> input {
> udp {
> type => "syslog"
> port => 5140
> }
> }
> 
> ```

and my filebeat.yml looks like this

> filebeat.prospectors:
> 
> - input\_type: log  
> paths:
> - /var/log/secure
> - /var/log/messages  
> document\_type: syslog

> - input\_type: log  
> paths:
> - /var/log/yum.log  
> document\_type: yumlog

> - input\_type: log  
> paths:
> - /var/log/nginx-access  
> document\_type: nginx-access

> - input\_type: log  
> paths:
> - /var/log/httpd/apache-access  
> document\_type: apache-access

> - input\_type: log  
> paths:
> - /var/log/cronlog  
> document\_type: cronlog

> - input\_type: log  
> paths:
> - /var/log/auditlog  
> document\_type: auditlog

> - input\_type: log  
> paths:
> - /var/log/maillog  
> document\_type: maillog

> output.logstash:  
> hosts: ["192.168.154.100:5044"]

> ssl.certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

It was working fine before but now it doesn't and I just don't get why?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2017, 2:19pm UTC](https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259/2 "2017-05-10T14:19:25Z")

</div>

Does Logstash start up properly? Have you looked in the Logstash log (typically in /var/log/logstash)?

---

<div class="post-metadata">

**Author:** ![RustuGurkan](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\
**Post date:** [May 10, 2017, 2:27pm UTC](https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259/3 "2017-05-10T14:27:55Z")

</div>

HI @magnusbaeck thanks for the reply  
Yes it does  
When I type  
sudo systemctl status logstash

it gives me

> logstash.service - logstash  
> Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: disabled)  
> Active: active (running) since Wed 2017-05-10 16:23:36 CEST; 1s ago  
> Main PID: 14345 (java)  
> CGroup: /system.slice/logstash.service  
> └─14345 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatin...

> May 10 16:23:36 kibana systemd[1]: logstash.service holdoff time over, scheduling restart.  
> May 10 16:23:36 kibana systemd[1]: Started logstash.  
> May 10 16:23:36 kibana systemd[1]: Starting logstash...

And I checked the logs but

logstash.err is empty  
logstash.log it says

> {:timestamp=\>"2017-05-10T15:23:02.163000+0200", :message=\>"Cannot get new connection from pool.", :class=\>"Elasticsearch::Transport::Transport::Error", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/transport/base.rb:193:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.15/lib/elasticsearch/transport/client.rb:125:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.15/lib/elasticsearch/api/actions/bulk.rb:87:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.5.5-java/lib/logstash/outputs/elasticsearch/http\_client.rb:53:in `non\_threadsafe\_bulk

And it keeps on going like this I don't understand it

I really don't know what to do

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2017, 2:38pm UTC](https://discuss.elastic.co/t/error-after-updating-to-elk-5/85259/4 "2017-06-07T14:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.