# Error - Manticore::SocketException: Connection refused

**URL:** <https://discuss.elastic.co/t/error-manticore-socketexception-connection-refused/46475>\
**Category:** Logstash\
**Created:** [April 6, 2016, 6:28am UTC](https://discuss.elastic.co/t/error-manticore-socketexception-connection-refused/46475 "2016-04-06T06:28:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradyumna\_Joshi](https://avatars.discourse-cdn.com/v4/letter/p/bbe5ce/32.png) [@Pradyumna\_Joshi](https://discuss.elastic.co/u/Pradyumna_Joshi)\
**Post date:** [April 6, 2016, 6:28am UTC](https://discuss.elastic.co/t/error-manticore-socketexception-connection-refused/46475/1 "2016-04-06T06:28:23Z")

</div>

I am trying to parse Bro IDS logs using ELK stack and getting this error:

Connection refused {:class=\>"Manticore::SocketException", :level=\>:error}  
Connection refused {:class=\>"Manticore::SocketException", :level=\>:error}  
Connection refused {:class=\>"Manticore::SocketException", :level=\>:error}  
Connection refused {:class=\>"Manticore::SocketException", :level=\>:error}

Google search tells me that this is due to the fact that logstash is trying to find elastic instance but not finding it.  
This is strange as this error is generated when I changed my output configuration recently.

## Output section of my logstash old and new configuration are as follows: Logstash: logstash 2.2.0 elastic - elastic 2.2.0 Old

output {  
#stdout { codec =\> rubydebug }  
if [type] == 'BRO\_dnslog' {  
elasticsearch {  
hosts =\> ["10.4.0.4", "10.4.0.8","10.4.0.9"]  
flush\_size =\> 2000  
workers =\>2  
index =\> "bro-dns-%{+YYYY.MM.dd}"  
}

```
    }

```

}

## New:

output {

```
    #stdout { codec => rubydebug }
    elasticsearch {
        hosts => ["10.4.0.4", "10.4.0.8","10.4.0.9"]
    flush_size => 2000
    workers =>2
        }
    if [type] == 'BRO_dnslog' {
        elasticsearch {
                    index => "bro-dns-%{+YYYY.MM.dd}"
            }

    }

```

}

The idea behind new configuration is to take out all the common settings of elastic in a separate block and only set index name as per Bro log [type]. The "--configtest" option of logstash also does not raise any errors for this case.

Any help/comment will be appreciated.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 6, 2016, 6:48am UTC](https://discuss.elastic.co/t/error-manticore-socketexception-connection-refused/46475/2 "2016-04-06T06:48:50Z")

</div>

This new configuration specifies two completely different Elasticsearch outputs where the first one will output all entries to the default logstash index and the second one will look to connect to the default, which is localhost:9200. All configuration for an output need to go into each block.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/error-manticore-socketexception-connection-refused/46475/3 "2017-07-06T05:03:38Z")

</div>