# I can't seem to connect to logstash for some reason?

**URL:** <https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209>\
**Category:** Logstash\
**Created:** [December 20, 2025, 5:48pm UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209 "2025-12-20T17:48:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Miksos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miksos/32/144363_2.png) [@Miksos](https://discuss.elastic.co/u/Miksos)\
**Post date:** [December 20, 2025, 5:48pm UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/1 "2025-12-20T17:48:31Z")

</div>

Dec 20 17:46:32 ELK-Server logstash[690]: [2025-12-20T17:46:32,609][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"khttp://localhost:9200/", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [khttp://localhost:9200/\][Manticore::ClientProtocolException] localhost:9200 failed to respond"}

This is the error I am getting. Not sure what I did wrong. I added “k” in front of the links cause it wouldn’t let me post it.

And here is my beats.conf

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    user => "elastic"
    password => " ***************"
    cacert => "/etc/elasticsearch/certs/http_ca.crt"
    index => "nmap-logs-%{+YYYY.MM.dd}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [December 21, 2025, 9:17am UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/2 "2025-12-21T09:17:12Z")

</div>

Hello @Miksos

Welcome to the Community!!

Could you please check if the elasticsearch is reachable on the URL “[https://localhost:9200](https://localhost:9200)” , you can try to do a test from logstash host :

```auto
curl -u elastic:<password> \
  --cacert /etc/elasticsearch/certs/http_ca.crt \
  https://localhost:9200

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 21, 2025, 6:14pm UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/3 "2025-12-21T18:14:31Z")

</div>

> [@Miksos](#):
>
> khttp://localhost:9200/

The 'k' a side

> [@Miksos](#):
>
> ```auto
> hosts => ["https://localhost:9200"]
> 
> ```

Your config uses `https` but the error says `http` which could indicate you are not using the config you think you are...

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [December 21, 2025, 8:02pm UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/4 "2025-12-21T20:02:13Z")

</div>

Or he had corrected beats.conf but not restarted LS or not using `config.reload.automatic: true`

---

<div class="post-metadata">

**Author:** ![Miksos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miksos/32/144363_2.png) [@Miksos](https://discuss.elastic.co/u/Miksos)\
**Post date:** [December 22, 2025, 10:59am UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/5 "2025-12-22T10:59:45Z")

</div>

Yes, I made a second config, and made a slight mistake there, I made an fix and it works as before, Thank you for the help !

---

<div class="post-metadata">

**Author:** ![Miksos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miksos/32/144363_2.png) [@Miksos](https://discuss.elastic.co/u/Miksos)\
**Post date:** [December 22, 2025, 11:00am UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209/6 "2025-12-22T11:00:20Z")

</div>

Thank you every one for the help !