Error - Manticore::SocketException: Connection refused

Elastic Stack Logstash
1

I am trying to parse Bro IDS logs using ELK stack and getting this error:

Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}
Connection refused {:class=>"Manticore::SocketException", :level=>:error}

Google search tells me that this is due to the fact that logstash is trying to find elastic instance but not finding it.
This is strange as this error is generated when I changed my output configuration recently.

Output section of my logstash old and new configuration are as follows:
Logstash: logstash 2.2.0
elastic - elastic 2.2.0
Old

output {
#stdout { codec => rubydebug }
if [type] == 'BRO_dnslog' {
elasticsearch {
hosts => ["10.4.0.4", "10.4.0.8","10.4.0.9"]
flush_size => 2000
workers =>2
index => "bro-dns-%{+YYYY.MM.dd}"
}

    }

}

New:

output {

    #stdout { codec => rubydebug }
    elasticsearch {
        hosts => ["10.4.0.4", "10.4.0.8","10.4.0.9"]
    flush_size => 2000
    workers =>2
        }
    if [type] == 'BRO_dnslog' {
        elasticsearch {
                    index => "bro-dns-%{+YYYY.MM.dd}"
            }

    }

}

The idea behind new configuration is to take out all the common settings of elastic in a separate block and only set index name as per Bro log [type]. The "--configtest" option of logstash also does not raise any errors for this case.

Any help/comment will be appreciated.

2

This new configuration specifies two completely different Elasticsearch outputs where the first one will output all entries to the default logstash index and the second one will look to connect to the default, which is localhost:9200. All configuration for an output need to go into each block.