# Failed to fetch X-pack information from ES - Failure to reach live ES Cluster

**URL:** <https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306>\
**Category:** Logstash\
**Created:** [October 24, 2022, 9:47am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306 "2022-10-24T09:47:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakinmayowa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakinmayowa/32/112369_2.png) [@jakinmayowa](https://discuss.elastic.co/u/jakinmayowa)\
**Post date:** [October 24, 2022, 9:47am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306/1 "2022-10-24T09:47:12Z")

</div>

I'm currently configuring Logstash ArcSight Module, however I've reached a road-block, error message below:

```auto
Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2022-10-24T10:09:00,755][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2022-10-24T10:09:00,761][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"8.4.3", "jruby.version"=>"jruby 9.3.8.0 (2.6.8) 2022-09-13 98d69c9461 OpenJDK 64-Bit Server VM 17.0.4+8 on 17.0.4+8 +indy +jit [x86_64-linux]"}
[2022-10-24T10:09:00,770][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[2022-10-24T10:09:00,952][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2022-10-24T10:09:01,727][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2022-10-24T10:09:02,257]**[ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"No Available connections"}**
[2022-10-24T10:09:02,282][**ERROR][logstash.licensechecker.modulelicensechecker] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.**
[2022-10-24T10:09:02,282][WARN][logstash.config.modulescommon] The arcsight module is not enabled. Please check the logs for additional information.
[2022-10-24T10:09:02,286][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2022-10-24T10:09:02,345][INFO][logstash.runner] Logstash shut down.
[2022-10-24T10:09:02,354][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~[jruby.jar:?]
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:753) ~[jruby.jar:?]
        at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:91) ~[?:?]

```

The module was configured with these commands:

```auto
 ./logstash --modules arcsight --setup --path.settings /etc/logstash/ -M "arcsight.var.inputs=smartconnector" -M "arcsight.var.elasticsearch.hosts=[Private IP]:9200" -M "arcsight.var.elasticsearch.username=elastic" -M "arcsight.var.elasticsearch.password=changeme" -M "arcsight.var.kibana.host=[Private IP]:5601" -M "arcsight.var.kibana.username=kibana" -M "arcsight.var.kibana.password=changeme" &

```

I am very new to Elasticsearch and judging from the logs it sems to suggest the ES node is unreachable? I must confirm that the node ES, Kibana and Logstash are all on the same machine. Netstat has confirmed that the ES node is currently using a private address to listen on port 9200, also on a 127.0.0.1 on port 5601.

Any help or advice on how to troubleshoot will be highly appreciated.

Thanks

> Blockquote

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 25, 2022, 4:30pm UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306/2 "2022-10-25T16:30:43Z")

</div>

It seems you have two issues:

- LS cannot see ES for licensing - Do you assigned proper rights to the user?
- The arcsight module is not enabled - Have you enabled/configured as mentioned in [the documentation](https://www.elastic.co/guide/en/logstash/current/logstash-modules.html#configuring-logstash-modules)

> [@jakinmayowa](#):
>
> ```auto
> [2022-10-24T10:09:02,257]**[ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"No Available connections"}**
> [2022-10-24T10:09:02,282][**ERROR][logstash.licensechecker.modulelicensechecker] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.**
> [2022-10-24T10:09:02,282][WARN][logstash.config.modulescommon] The arcsight module is not enabled. Please check the logs for additional information.
> [2022-10-24T10:09:02,286][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
> [
> 
> ```

---

<div class="post-metadata">

**Author:** ![jakinmayowa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakinmayowa/32/112369_2.png) [@jakinmayowa](https://discuss.elastic.co/u/jakinmayowa)\
**Post date:** [November 2, 2022, 10:49am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306/3 "2022-11-02T10:49:12Z")

</div>

Version 8.4 of ELK comes with basic security as default. So I should have configured the Logstash instance to can contact the ES instance securely so this is done by adding the X509 CA created when Elastic is initially installed located in /etc/elasticsearch/certs/http\_ca.crt.  
Logstash will need a copy of that, and this I did by creating a certs directory in /etc/logstash

I was then able to run a test pipeline from the command-line successfully

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2022, 10:49am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306/4 "2022-11-30T10:49:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.