# Error on logstash, can't connect to elasticsearch

**URL:** <https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674>\
**Category:** Logstash\
**Created:** [September 4, 2015, 11:10am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674 "2015-09-04T11:10:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aditya\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@Aditya\_Patel](https://discuss.elastic.co/u/Aditya_Patel)\
**Post date:** [September 4, 2015, 11:10am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/1 "2015-09-04T11:10:39Z")

</div>

Hi

Currently I am using logstash forwarder , logstash and elasticsearch to monitor my syslogs on various machines. It was working fine but it stopped working all of sudden. I noticed my logstash had stopped working.

When i tried restarting my logstash, it displayed following error in logstash.logs. It is currently in start condition but not being able to connect with elasticsearch.

message=\>"Got error to send bulk of actions to elasticsearch server at localhost : blocked by: [SERVICE\_UNAVAILABLE/1/state not recovered / initialized];

Does anybody know how to debug the issue.

My logstash config file is following:

```
output {
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

```

Elasticsearch cluster is pretty basic , one thing i have done is that initially i had started out with one machine and recently i converted it into two machines but my hostname has remained "localhost" for elasticsearch.

Thanks!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 5, 2015, 11:32pm UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/2 "2015-09-05T23:32:02Z")

</div>

This means your ES cluster is not in a healthy state.

What does `curl ES_IP:9200/_cat/health` show?

---

<div class="post-metadata">

**Author:** ![Aditya\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@Aditya\_Patel](https://discuss.elastic.co/u/Aditya_Patel)\
**Post date:** [September 6, 2015, 4:21am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/3 "2015-09-06T04:21:47Z")

</div>

Hi Mark,

Thanks for the reply, i checked the elasticsearch cluster is working correctly. If i try to insert something directly it gets inserted and i can view it in kibana as well. Following is the output of the command:

```
curl localhost:9200/_cluster/health?pretty
{
  "cluster_name" : "elasticsearch",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 2,
  "number_of_data_nodes" : 2,
  "active_primary_shards" : 466,
  "active_shards" : 932,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 6, 2015, 9:19pm UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/4 "2015-09-06T21:19:47Z")

</div>

Try adding this to the ES output config;

```auto
protocol => http

```

---

<div class="post-metadata">

**Author:** ![Aditya\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@Aditya\_Patel](https://discuss.elastic.co/u/Aditya_Patel)\
**Post date:** [September 9, 2015, 11:23am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/5 "2015-09-09T11:23:51Z")

</div>

Hi

I added it but it didn't work.  
In the end , i had to clear my logstash.log history and followed the following link which made it work:

> **[How to setup an Elasticsearch cluster with Logstash on Ubuntu 12.04](https://deviantony.wordpress.com/2014/09/23/how-to-setup-an-elasticsearch-cluster-with-logstash-on-ubuntu-12-04/)**
>
> Hey there ! I’ve recently hit the limitations of a one node elasticsearch cluster in my ELK setup, see my previous blog post: Centralized logging with an ELK stack (Elasticsearch-Logback-Kiba…

After this it started working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674/6 "2017-07-06T05:29:37Z")

</div>