Error: initialize: name or service not known

[prashansa1 (Prashansa Rani)]

I'm trying to execute logstash script from local to connect with external server.

but It is throwing these errors.

ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin
Plugin: <LogStash::Inputs::Elasticsearch hosts=>["{external_logstash_host}"], index=>"{index_name}", type=>"{index_data_type}", query=>"{\n\t\t"query": {"bool":{"must":[{"match":{"test_id":"12xxxx"}},\n\t\t{"range":{"test_tms": {"gte":"2018-07-23T04:00:35.000Z","lte":"2018-07-23T05:00:35.000Z"}}}]\n\t\t\n\t\t\n\t\t}}\n\t\t}", add_field=>{"file_date"=>""}, user=>"{user_name}", password=>, ssl=>true, docinfo=>true, id=>"{id_value}", enable_metric=>true, codec=><LogStash::Codecs::JSON id=>"{json_id}", enable_metric=>true, charset=>"UTF-8">, size=>1000, scroll=>"1m", docinfo_target=>"@metadata", docinfo_fields=>["_index", "_type", "_id"]>

Error: initialize: name or service not known

[guyboertje]

I think you are trying to use interpolation.

The syntax is %{fieldname}

The elasticsearch output setting hosts does not allow interpolation, some settings do but a lot don't.

[prashansa1 (Prashansa Rani)]

Hi, thanks for valuable feedback It would be really helpful if you could explain in detail.

[prashansa1 (Prashansa Rani)]

Hi @guyboertje Now i'm getting this error , please can you explain

06:08:05.941 [[main]<elasticsearch] ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Elasticsearch hosts=>["{logstash_host}"], index=>"test_index*", type=>"test_type", query=>"{"query": {"bool":{"must":[{"match":{"test_id":"12******"}},{"range":{"test_tms": {"gte":"2018-07-26T05:07:20.000Z","lte":"2018-07-26T06:07:20.000Z"}}}]}}}", add_field=>{"file_date"=>""}, user=>"username", password=>, ssl=>true, docinfo=>true, id=>"123456", enable_metric=>true, codec=><LogStash::Codecs::JSON id=>"234569", enable_metric=>true, charset=>"UTF-8">, size=>1000, scroll=>"1m", docinfo_target=>"@metadata", docinfo_fields=>["_index", "_type", "_id"]>
Error: 400 "Bad Request"

[guyboertje]

LogStash::Inputs::Elasticsearch hosts=>["{logstash_host}"], index=>"test_index*"...

I think the value inside the hosts array is not a valid host name.

Do you have a DNS entry for '{logstash_host}'?

Do you have a etc/hosts entry for '{logstash_host}'?

Use the IP or host name of the machine that Elasticsearch is running on.