error=>"Elasticsearch Unreachable:

Hi,
i was running the latest version of ELK stack and decided to add x-pack to it, after which when i tried to run the configuration file in logstash it throws me the following error

[INFO ] 2018-04-11 06:09:25.860 [main] scaffold - Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[INFO ] 2018-04-11 06:09:25.880 [main] scaffold - Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[INFO ] 2018-04-11 06:09:26.254 [main] scaffold - Initializing module {:module_name=>"arcsight", :directory=>"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/x-pack-6.2.3-java/modules/arcsight/configuration"}
[WARN ] 2018-04-11 06:09:26.828 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2018-04-11 06:09:27.129 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.2.3"}
[INFO ] 2018-04-11 06:09:27.380 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[WARN ] 2018-04-11 06:09:28.176 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] elasticsearch - You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch hosts=>[http://localhost:9200], bulk_path=>"/_xpack/monitoring/_bulk?system_id=logstash&system_api_version=2&interval=1s", manage_template=>false, document_type=>"%{[@metadata][document_type]}", sniffing=>false, id=>"8e126056909147d749c2e21d4df5a526c2b41da050e1288d2a23c33a59fd672b", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_21301093-6ba2-4ede-b638-7bfc4d786332", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, action=>"index", ssl_certificate_verification=>true, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}

[INFO ] 2018-04-11 06:09:28.686 [[.monitoring-logstash]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[INFO ] 2018-04-11 06:09:28.692 [[.monitoring-logstash]-pipeline-manager] elasticsearch - Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"}
[WARN ] 2018-04-11 06:09:28.854 [[.monitoring-logstash]-pipeline-manager] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[INFO ] 2018-04-11 06:09:28.863 [[.monitoring-logstash]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]}
[INFO ] 2018-04-11 06:09:29.786 [[.monitoring-logstash]-pipeline-manager] licensereader - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[INFO ] 2018-04-11 06:09:29.787 [[.monitoring-logstash]-pipeline-manager] licensereader - Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"}
[WARN ] 2018-04-11 06:09:29.796 [[.monitoring-logstash]-pipeline-manager] licensereader - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[WARN ] 2018-04-11 06:09:29.832 [[.monitoring-logstash]-pipeline-manager] licensereader - Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused) {:url=>http://localhost:9200/, :error_message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)
[ERROR] 2018-04-11 06:09:29.845 [[.monitoring-logstash]-pipeline-manager] licensemanager - Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[WARN ] 2018-04-11 06:09:29.849 [[.monitoring-logstash]-pipeline-manager] xpackinfo - Nil response from License Server
[INFO ] 2018-04-11 06:09:29.886 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Pipeline started succesfully {:pipeline_id=>".monitoring-logstash", :thread=>"#<Thread:0x2a453264@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:246 run>"}
"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

I am not sure why logstash is trying to reach localhost:9200, when i have configured the logstash to reach 192.168.46.135:9200

my configuration files

output {
elasticsearch{
hosts => ["192.168.46.135:9200"]
protocol => http
}
stdout {codec => rubydebug}
}

logstash.yml

Settings file in YAML

Settings can be specified either in hierarchical form, e.g.:

pipeline:

batch:

size: 125

delay: 5

Or as flat keys:

pipeline.batch.size: 125

pipeline.batch.delay: 5

------------ Node identity ------------

node.name: test

------------ Data path ------------------

path.data: /var/lib/logstash

------------ Pipeline Settings --------------

path.logs: /var/log/logstash

------------ Other Settings --------------

Where to find custom plugins

path.plugins: []

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.url: http://192.168.46.135:9200
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.