# How to make Logstash talk to Elasticsearch?

**URL:** <https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [April 1, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080 "2020-04-01T15:31:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimWardFS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timwardfs/32/65108_2.png) [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\
**Post date:** [April 1, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080/1 "2020-04-01T15:31:11Z")

</div>

I have Elasticsearch running in K8s via the operator, and want to talk to it from Logstash.

Everything I've tried so far has failed, mostly resulting in

```auto
[2020-04-01T15:25:22,773][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://elasticsearch-es-http:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://elasticsearch-es-http:9200/][Manticore::ClientProtocolException] elasticsearch-es-http:9200 failed to respond"}

```

I don't want to worry about TLS just yet - I want to make it work first, and worry about security later. I have found hints that it's necessary to turn off TLS via

```auto
spec:
  http:
    tls:
      selfSignedCertificate:
        disabled: true

```

but that doesn't make any difference.

---

<div class="post-metadata">

**Author:** ![TimWardFS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timwardfs/32/65108_2.png) [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\
**Post date:** [April 1, 2020, 3:38pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080/2 "2020-04-01T15:38:54Z")

</div>

Ah, finger trouble, it turns out that that does make a difference - I'm now getting 401 which suggests I just need to find a username and password.

---

<div class="post-metadata">

**Author:** ![sebgl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebgl/32/48702_2.png) [@sebgl](https://discuss.elastic.co/u/sebgl)\
**Post date:** [April 2, 2020, 1:25pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080/3 "2020-04-02T13:25:32Z")

</div>

@TimWardFS did you manage to sort things out?

Regarding TLS, you can also keep TLS enabled and either:

- configure Logstash in such a way that it ignores server certificates validation
- mount the TLS certificates secret of Elasticsearch into the Logstash Pod, and configure it to trust those certificates

---

<div class="post-metadata">

**Author:** ![TimWardFS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timwardfs/32/65108_2.png) [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\
**Post date:** [April 6, 2020, 10:23am UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080/4 "2020-04-06T10:23:13Z")

</div>

I have, for now,

(1) turned off TLS (disabling selfSignedCertificate did work once I'd got it right)  
(2) created the secret for the password for the "elastic" user manually so as not to get a generated one - would be nice to have this as a documented feature rather than something that is known to work just right now but not guaranteed to remain working in future versions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:51am UTC](https://discuss.elastic.co/t/how-to-make-logstash-talk-to-elasticsearch/226080/5 "2022-11-04T07:51:49Z")

</div>