# Error while connecting logstash to elasticsearch : Attempted to resurrect connection to dead ES instance, but got an error
**URL:** https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106
**Category:** Logstash
**Tags:** docker
**Created:** [January 27, 2023, 12:14pm UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106 "2023-01-27T12:14:03Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 27, 2023, 12:14pm UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/1 "2023-01-27T12:14:03Z")
logstash | [2023-01-27T11:56:05,943][INFO][logstash.javapipeline][.monitoring-logstash] Pipeline started {"pipeline.id"=\>".monitoring-logstash"}
logstash | [2023-01-27T11:56:05,956][INFO][logstash.agent] Pipelines running {:count=\>2, :running\_pipelines=\>[:main, :".monitoring-logstash"], :non\_running\_pipelines=\>}
logstash | [2023-01-27T11:56:06,191][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
logstash | [2023-01-27T12:09:23,612][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://127.0.0.1:9200/](http://127.0.0.1:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://127.0.0.1:9200/](http://127.0.0.1:9200/)'"}
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 27, 2023, 1:03pm UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/2 "2023-01-27T13:03:53Z")
Hello and welcome to the community,
Please describe your issue, jsut pasting the log error do not give any context about your issue.
> "Got response code '401' contacting Elasticsearch at URL '[http://127.0.0.1:9200/](http://127.0.0.1:9200/)'"
The error is pretty clear, you have an authorization issue, check your username and password, also, remove the `/` in the end of the host, not sure if this can lead to some issue, but you do not need it at the end.
---
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 29, 2023, 4:57am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/3 "2023-01-29T04:57:47Z")
I haven't defined 127.0.0.1:9200 anywhere in the logstash..yaml and config file.
Also In the logs I am to able see logstash is able to make the connection with ip the of the host (100.2.X.X:9200) . But after that somehow this 127.0.0.1 is getting added in the pool and then trying to make the connection with this .. which I am not able to figured it out.
NOTE : this issue I am getting after I have added basic authentication in ELK , And I verified I am giving the correct credentials in logstash , even I verified manually also , you can see it is able to authenticate with the actual IP of the host.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 29, 2023, 5:14am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/4 "2023-01-29T05:14:39Z")
It sounds like you have legacy xpack monitoring enabled. You have two pipelines -- main (your pipeline) and monitoring-logstash. I believe that is [xpack](https://www.elastic.co/guide/en/logstash/current/monitoring-internal-collection-legacy.html). See [here](https://www.elastic.co/guide/en/logstash/current/monitoring-internal-collection-legacy.html#monitoring-general-settings-legacy). The default address to which monitoring information is sent is localhost. So if you require authorisation then that will also require authorisation.
---
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 29, 2023, 7:39am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/5 "2023-01-29T07:39:26Z")
could you please elaborate , what do u mean by "if you require authorisation then that will also require authorisation." ,
Do u mean I need it add 127.0.0.1 in the hosts list in the yaml and conf file.
Thanks In Advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 29, 2023, 5:46pm UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/6 "2023-01-29T17:46:26Z")
I am saying that if you have added "basic authentication in ELK" then you need to configure a username and password for xpack. See the fourth item in the documentation I [linked](https://www.elastic.co/guide/en/logstash/current/monitoring-internal-collection-legacy.html#monitoring-general-settings-legacy) to.
---
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 30, 2023, 3:49am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/7 "2023-01-30T03:49:39Z")
That I have already added in both yaml and conf file. Also I can see logstash is able to authenticate with the ip of the host machine, but after that it is trying to connect with 127.0.0.1 then the above error throwing
---
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 30, 2023, 7:33am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/8 "2023-01-30T07:33:00Z")
Issue resolved by adding eslatic user name password in conf file
---
### Author:  [@abhay14](https://discuss.elastic.co/u/abhay14)
#### Post date: [January 30, 2023, 7:33am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/9 "2023-01-30T07:33:40Z")
Elastic username and password worked
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2023, 7:33am UTC](https://discuss.elastic.co/t/error-while-connecting-logstash-to-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/324106/10 "2023-02-27T07:33:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.