# Failed to fetch X-Pack information from Elasticsearch

**URL:** <https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712>\
**Category:** Logstash\
**Created:** [April 13, 2020, 12:52am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712 "2020-04-13T00:52:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![enricobachiorrini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enricobachiorrini/32/66189_2.png) [@enricobachiorrini](https://discuss.elastic.co/u/enricobachiorrini)\
**Post date:** [April 13, 2020, 12:52am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/1 "2020-04-13T00:52:19Z")

</div>

Hello,  
I'm setting up elasticsearch and [centralized pipeline management](https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html).  
Elasticsearch crashes with these errors:

```auto
[2020-04-13T00:41:44,943][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2020-04-13T00:41:45,021][ERROR][logstash.configmanagement.elasticsearchsource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

```

I am using `cloud_id` and `cloud_auth` in the `logstash.yml` configuration. This is what it looks like:

```auto
path.data: /var/lib/logstash
cloud.id: <cluster>:<string>
cloud.auth: elastic:<password>
log.level: info
path.logs: /var/log/logstash
xpack.management.enabled: true
xpack.management.pipeline.id: ["mypipeline"]
xpack.management.elasticsearch.cloud_id: <cluster>:<string>
xpack.management.elasticsearch.cloud_auth: elastic:<password>

```

This is the complete log:

```auto
[2020-04-13T00:48:45,460][INFO][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline_id=>["mypipeline"], :poll_interval=>"5000000000ns"}
[2020-04-13T00:48:47,305][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2020-04-13T00:48:47,392][ERROR][logstash.configmanagement.elasticsearchsource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
[2020-04-13T00:48:47,406][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::LicenseChecker::LicenseError: Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.>, :backtrace=>["/usr/share/logstash/x-pack/lib/license_checker/licensed.rb:67:in `with_license_check'", "/usr/share/logstash/x-pack/lib/config_management/elasticsearch_source.rb:55:in `initialize'", "/usr/share/logstash/x-pack/lib/config_management/hooks.rb:41:in `after_bootstrap_checks'", "org/logstash/execution/EventDispatcherExt.java:71:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:299:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:242:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in `<main>'"]}
[2020-04-13T00:48:47,418][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

```

It looks like it's trying to connect to `127.0.0.1:9200` (where I don't have elasticsearch) instead of the cloud cluster.  
I created the pipeline `mypipeline` in Logstash Pipelines from the Kibana Management and its syntax is correct. This pipeline works fine if I save it in a `/conf.d/mypipeline.conf` instead of centralized pipeline management.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 13, 2020, 1:24am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/2 "2020-04-13T01:24:48Z")

</div>

> [@enricobachiorrini](#):
>
> I am using `cloud_id` and `cloud_auth` in the `elasticsearch.yml` configuration.

Did you really create that in `elasticsearch.yml` file?  
It's expected to be in your `logstash.yml` file.

> **[Configure Centralized Pipeline Management | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/configuring-centralized-pipelines.html)**

---

<div class="post-metadata">

**Author:** ![enricobachiorrini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enricobachiorrini/32/66189_2.png) [@enricobachiorrini](https://discuss.elastic.co/u/enricobachiorrini)\
**Post date:** [April 13, 2020, 8:29am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/3 "2020-04-13T08:29:16Z")

</div>

There was a typo in my original message, I am using `logstash.yml` and not `elasticsearch.yml`. Yes, both `xpack.management.elasticsearch.cloud_id` and `xpack.management.elasticsearch.cloud_auth` are defined in the `logstash.yml` file but it’s not working. Logstash is looking for a Elsticsearch instance in my server even though elasticsearch isn’t even an output of the centralized pipeline. The only output I am using is stdout for testing.  
I think it's looking for a local Elasticsearch instance for the first log line:  
`[INFO][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline_id=>["mypipeline"], :poll_interval=>"5000000000ns"}`, but I am not using Logstash locally, only in the cloud. How can I fix this?

---

<div class="post-metadata">

**Author:** ![Mike.Heyns](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Mike.Heyns](https://discuss.elastic.co/u/Mike.Heyns)\
**Post date:** [April 17, 2020, 12:58am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/4 "2020-04-17T00:58:35Z")

</div>

We're facing the same error.

Configured `logstash.yml` in the same manner.

```auto
Unable to retrieve license information from license server
{:message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/]

```

Using Elastic Cloud with the latest logstash rpm.

---

<div class="post-metadata">

**Author:** ![Mike.Heyns](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Mike.Heyns](https://discuss.elastic.co/u/Mike.Heyns)\
**Post date:** [April 17, 2020, 1:27am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/5 "2020-04-17T01:27:12Z")

</div>

I'm not sure if this is correct, but it looks like a relevant fix has been merged a few hours ago, due for logstash 7.7.0

> <https://github.com/elastic/logstash/pull/11800>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2020, 1:27am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712/6 "2020-05-15T01:27:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
