# Error sending logs to Elastic After porting a pipeline configuration to docker **URL:** \ **Category:** Logstash\ **Created:** [January 23, 2018, 9:41pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757 "2018-01-23T21:41:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ajstark123](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Post date:** [January 23, 2018, 9:41pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/1 "2018-01-23T21:41:41Z")
We have a working pipeline configuration file which we are porting to Docker. We are seeing the following warnings in the logs. We do not have any security configured on our Elastic Search. What is very puzzling is that logstash is trying to reach an ElasticSearch environment on my PC via local host. But the logstash pipeline configuration specifies hosts =\> ["[monatee-loggy-master-tpc.dev.bnymellon.net:80](http://monatee-loggy-master-tpc.dev.bnymellon.net:80)"] . Why would logstash try to connect to Elasticsearch locally? **Docker Command** docker run --rm --mount type=bind,source=/c/Users/Public/logstash/config\_pipeline,destination=/usr/share/logstash/pipeline --mount type=bind,source=/c/Users/Public/logstash/config,destination=/usr/share/logstash/config --mount type=bind,source=/c/Users/Public/logstash/config\_kafka,destination=/usr/share/logstash/config\_kafka --mount type=bind,source=/c/Users/Public/logstash/logs,destination=/usr/share/logstash/logs [docker.elastic.co/logstash/logstash:6.1.2](http://docker.elastic.co/logstash/logstash:6.1.2) **LS of Directories and files** drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 13:21 /c/Users/Public/ drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 13:46 /c/Users/Public/logstash/ drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 13:39 /c/Users/Public/logstash/config/ drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 13:07 /c/Users/Public/logstash/config\_kafka/ -rw-r--r-- 1 xeccgtt 1052689 133 Nov 13 08:28 /c/Users/Public/logstash/config\_kafka/kafka\_client\_jaas\_logstash.conf drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 11:57 /c/Users/Public/logstash/config\_pipeline/ -rw-r--r-- 1 xeccgtt 1052689 1743 Jan 23 16:30 /c/Users/Public/logstash/config\_pipeline/pipeline.conf drwxr-xr-x 1 xeccgtt 1052689 0 Jan 23 15:25 /c/Users/Public/logstash/logs/ **Logs:** [2018-01-23T21:14:35,208][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"} [2018-01-23T21:14:35,216][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"} [2018-01-23T21:14:35,362][INFO][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"} **PIPELINE CONFIGURATION** input { kafka { bootstrap\_servers =\> "[rsomtapae182.bnymellon.net:9092](http://rsomtapae182.bnymellon.net:9092),[rsomtapae183.bnymellon.net:9092](http://rsomtapae183.bnymellon.net:9092),[rsomtapae184.bnymellon.net:9092](http://rsomtapae184.bnymellon.net:9092)" topics =\> ["monatee\_loggy\_tpc"] jaas\_path =\> "/usr/share/logstash/config\_kafka/kafka\_client\_jaas\_logstash.conf" security\_protocol =\> "SASL\_PLAINTEXT" sasl\_kerberos\_service\_name =\> "kafka" sasl\_mechanism =\> "PLAIN" group\_id =\> "monatee\_loggy\_tpc" decorate\_events =\> true codec =\> json client\_id =\> loggy\_albert\_pc add\_field =\> { "filebeat\_timestamp" =\> "%{@timestamp}" } } } # The filter part of this file is commented out to indicate that it is # optional. filter { grok { match =\> { "message" =\> "%{SYSLOG5424PRI}\*%{SYSLOGTIMESTAMP:syslog\_time} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } } date { match =\> [ "syslog\_time", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "ISO8601" ] } ruby { code =\> "event.set('logstash\_2\_received\_time', Time.now.utc.strftime('%FT%T.%L') )" } mutate { add\_field =\> ["logstash\_2\_server", "albert\_pc"] } } output { # stdout { codec =\> rubydebug } elasticsearch { hosts =\> ["[monatee-loggy-master-tpc.dev.bnymellon.net:80](http://monatee-loggy-master-tpc.dev.bnymellon.net:80)"] index =\> "monatee\_loggy\_syslog\_tpc-%{+YYYY.MM.dd}" document\_type =\> "syslog" } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 23, 2018, 9:44pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/2 "2018-01-23T21:44:19Z")
> Why would logstash try to connect to Elasticsearch locally? Because of the monitoring configuration in logstash.yml? ---
**Author:** ![ajstark123](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Post date:** [January 23, 2018, 9:50pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/3 "2018-01-23T21:50:38Z")
In logstash.yml we have the following entries path.config: /usr/share/logstash/pipeline http.host: "0.0.0.0" log.level: info path.logs: /usr/share/logstash/logs We are try to use the docker mount option to map the directories under /c/Users/Public/logstash to directories under /usr/share/logstash ---
**Author:** ![ajstark123](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Post date:** [January 23, 2018, 9:56pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/4 "2018-01-23T21:56:37Z")
We are seeing this error in Logs. My elastic search does not have security set what configurations should we add for xpack in the yml file. [2018-01-23T20:25:19,491][ERROR][logstash.inputs.metrics] Monitoring is not available: License information is currently unavailable. Please make sure you have added your production elasticsearch connection info in the xpack.monitoring.elasticsearch settings. ---
**Author:** ![ajstark123](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Post date:** [January 23, 2018, 10:20pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/5 "2018-01-23T22:20:26Z")
We tried to turn off xpack by adding this flag, **-e "xpack.security.enabled=false"** , to the docker run command and we still had the same issue. We tried adding this line to logstash.yml: > xpack.security.enabled: false Now we are getting this error. **This is starting to get frustrating. There has to be be away to turn off the xpack security.** > [2018-01-23T22:15:59,576][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:32:in `get_setting'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:65:in `set\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:84:in `block in merge'", "org/jruby/RubyHash.java:1343:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:84:in `merge'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:133:in `validate\_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:259:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:214:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:67:in `'"]} docker run --rm -e "xpack.security.enabled=false" --mount type=bind,source=/c/Users/Public/logstash/config\_pipeline,destination=/usr/share/logstash/pipeline --mount type=bind,source=/c/Users/Public/logstash/config,destination=/usr/share/logstash/config --mount type=bind,source=/c/Users/Public/logstash/config\_kafka,destination=/usr/share/logstash/config\_kafka --mount type=bind,source=/c/Users/Public/logstash/logs,destination=/usr/share/logstash/logs [docker.elastic.co/logstash/logstash:6.1.2](http://docker.elastic.co/logstash/logstash:6.1.2) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 20, 2018, 10:20pm UTC](https://discuss.elastic.co/t/error-sending-logs-to-elastic-after-porting-a-pipeline-configuration-to-docker/116757/6 "2018-02-20T22:20:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.