# Error Connecting Logstash to Found Elasticsearch **URL:** \ **Category:** Logstash\ **Created:** [July 9, 2015, 6:21am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207 "2015-07-09T06:21:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ScottLawrenceLawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scottlawrencelawson/32/3644_2.png) [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Post date:** [July 9, 2015, 6:21am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/1 "2015-07-09T06:21:58Z")
I am a total newbie to ELK stack and am following along with this tutorial ([https://www.found.no/foundation/analyzing-weblogs-with-elasticsearch/](https://www.found.no/foundation/analyzing-weblogs-with-elasticsearch/)) on my Win7 Laptop. I installed all bits and got LS working with the basic examples and now am trying to connect to my Found ES instance. I made the example .conf file and when I run this command "$ bin/logstash agent --verbose -f found.conf" at the end I get the error: "message=\>"Failed to install template: connect timed out", :level=\>:error". Do I need to install a template and if so what do I do there? Thanks, apologies for the basic questions but could not find info about it. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 9, 2015, 11:06am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/2 "2015-07-09T11:06:54Z")
What does your found.conf file look like? ---
**Author:** ![ScottLawrenceLawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scottlawrencelawson/32/3644_2.png) [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Post date:** [July 9, 2015, 2:24pm UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/3 "2015-07-09T14:24:26Z")
Here is is below. I got this from the "how to" article. I obscured the host name while posting here. The article did not specify exactly what part of the hostname to put in, I tired several combinations of the name with the "..aws.found.io" with and without it. Seemed to make no difference. Thanks! =========================== input { stdin{} } output { elasticsearch { protocol =\> http host =\> a6793c . . . facd8e7 port =\> 9243 # Check the port also ssl =\> true } stdout { codec =\> rubydebug } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 10, 2015, 2:11am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/4 "2015-07-10T02:11:19Z")
It's probably because your host value doesn't look right. ---
**Author:** ![ScottLawrenceLawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scottlawrencelawson/32/3644_2.png) [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Post date:** [July 10, 2015, 4:16am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/5 "2015-07-10T04:16:50Z")
I am sure that is the reason, but I cannot find any reference to tell me how the .conf file should be formatted. Can you help me find that? I know ES in Found is new . . . I have tried: https:/ /a6793--OBSCURED--cd8e7.us-east-1.aws.found.io:9243 Just the URI (no port) Element separated into value pairs as shown in the tutorial And many other combinations Any help is deeply appreciated! 🙂 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 10, 2015, 4:30am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/6 "2015-07-10T04:30:42Z")
You should have something like `host => foundclusterid-awsregion.foundcluster.com`, not `host => a6793c . . . facd8e7`. Also, do you have ACLs setup\> This is how you format the config for that output - [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html) ---
**Author:** ![ScottLawrenceLawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scottlawrencelawson/32/3644_2.png) [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Post date:** [July 10, 2015, 4:54am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/7 "2015-07-10T04:54:09Z")
Hi. The " . . . " was simply to obscure my cluster ID. 😄 My full filename.conf file is this below: ``` input { stdin{} } output { elasticsearch { protocol => http host => a6783cxxx.us-east-1.aws.found.io port => 9243 ssl => true } stdout { codec => rubydebug } } ``` But that does not work. I get this error: ``` Error: Expected one of #, {, } at line 6, column 45 (byte 112) after output { elasticsearch { protocol => http host => a6783cxxx ``` I do not have ACLs setup yet, as I am just trying to get this test working as simple as possible. The URL you provide is nice, but it talks about how to format the conf file for locally installed ES, not the ES Found in the clous which requires a different port and format. I tried to just put the whole string for my Found cluster in the conf file and outside of a conf file (using the "-e" parameter, but that did not work either. 😖 Any help is appreciated!! -Scott ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 10, 2015, 4:58am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/8 "2015-07-10T04:58:31Z")
You need quotes around various things, check the docs that I linked to. ---
**Author:** ![ScottLawrenceLawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scottlawrencelawson/32/3644_2.png) [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Post date:** [July 10, 2015, 5:13am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/9 "2015-07-10T05:13:07Z")
OK! Thanks, Mark, finally! The "Host =\>" section needed the whole hostname and it needed quotes around it. I guess because of the dot separators (.) in the URL. I will comment to the author of the tutorial to make this explicit. Many thanks for the help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/error-connecting-logstash-to-found-elasticsearch/25207/10 "2017-07-06T05:35:04Z")