Hosts as name instead of IP?


(Albert Shamsiyan) #1

in my conf file, can I use the Elasticsearch machine "name" instead of IP? tried using
hosts => ["Elasticsearch:9200"] yet failed. notice that I CAN ping Elasticsearch ..

THX -Albert.


(Lewis Barclay) #2

It should be:

hosts => ["http://elasticsearch:9200"]

(Albert Shamsiyan) #3

aftre implementing the change, log shows
[2018-11-21T09:21:05,477][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[http://:9200/]}}
[2018-11-21T09:21:05,485][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://:9200/, :path=>"/"}
[2018-11-21T09:21:05,597][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://:9200/][Manticore::ClientProtocolException] URI does not specify a valid host name: http:/"}
[2018-11-21T09:21:05,619][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://Master_Elasticsearch:9200"]}
[2018-11-21T09:21:05,788][INFO ][logstash.filters.geoip ] Using geoip database {:path=>"/usr/local/logstash-6.5.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-geoip-5.0.3-java/vendor/GeoLite2-City.mmdb"}
???


(Lewis Barclay) #4

What version of ES/Logstash are you using?


(Albert Shamsiyan) #5

logstash = 6.5.0
kibana = 6.4.1
elasticsearch = 6.4.1


(Lewis Barclay) #6

Can I see your logstash config file?


(Albert Shamsiyan) #7

input
{
file {
path => "/usr/src/octopus/MyProd-1.0.0.log"
type => "logs"
start_position => "beginning"
}

}

filter
{
grok{
match => {
"message" => "%{COMBINEDAPACHELOG}"
}
}
mutate{
convert => { "bytes" => "integer" }
}
date {
match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
locale => en
remove_field => "timestamp"
}
geoip {
source => "clientip"
}
useragent {
source => "agent"
target => "useragent"
}
}

output
{
stdout {
codec => dots
}

elasticsearch {
	hosts => ["172.18.0.5:9200"] --> working
	hosts => ["http://Elasticsearch:9200"] --> Not working
	index => "MyProd"
}

}


(Lewis Barclay) #8

Have you tried with the FQDN? So the domain name at the end of the host name?


(Albert Shamsiyan) #9

Works fine now - Thx


(Lewis Barclay) #10

Glad you got it, please mark the answer as solution if it helped!