# I see this error in logstash-plain.log **URL:** \ **Category:** Elasticsearch\ **Created:** [September 28, 2023, 4:02pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082 "2023-09-28T16:02:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 4:02pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/1 "2023-09-28T16:02:32Z")
I installed elastcisearch 8.10.20 and kibana 810.2 and logstash 8.10.2 and filebeat 10.8.2 RPM on my oracle Linux, everything is running and I can login to kibana dashboard after adding token and username and password, but I do not see filebeat log. I want filebeat send logs to logstash and after that logstash send them to elastcsearch, I see these logs in logstash logs ```auto 2023-09-28T19:29:16,197][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:16,198][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-28T19:29:21,200][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:21,201][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-28T19:29:26,204][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:26,204][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respon ``` I want to solve this problem with easy way. ---
**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\ **Post date:** [September 28, 2023, 6:00pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/2 "2023-09-28T18:00:20Z")
It seems like your Elasticsearch is not up and running. Please check [http://localhost:9200](http://localhost:9200) is working before you start logstash. ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 6:33pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/3 "2023-09-28T18:33:47Z")
Thanks, but systemctl status show the elasticsearch is running and up ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 28, 2023, 7:32pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/4 "2023-09-28T19:32:58Z")
> [@Mostafa\_Faridi](#): > > `http://localhost:9200/` Are you using HTTPS on ES perhaps? If you do, change on LS side as well. ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 7:35pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/5 "2023-09-28T19:35:00Z")
I do not think so, because kibana load with http , I install ELK stach with default installation ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 28, 2023, 7:46pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/6 "2023-09-28T19:46:56Z")
Have you set certificate params in output? ```auto elasticsearch { hosts => ["https://localhost:9200"] ssl_enabled => true ssl_verification_mode => "none" # ssl_certificate_authorities => ["/path/to/ca.crt"] # ssl_certificate => "/path/to/logstash.crt" # ssl_key => "/path/to/logstash.pkcs8.key" } ``` ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 7:56pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/7 "2023-09-28T19:56:13Z")
> [@Rios](#): > > ```auto > ssl_enabled => true > ssl_verification_mode => "none" > > ``` Thanks, I put them in /etc/logstash/conf.d/beats.conf but I see that error again ```auto 2023-09-28T19:29:16,197][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:16,198][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-28T19:29:21,200][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:21,201][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-28T19:29:26,204][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-28T19:29:26,204][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpCli ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 28, 2023, 8:18pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/8 "2023-09-28T20:18:49Z")
> [@Mostafa\_Faridi](#): > > I do not think so, because kibana load with http , I install ELK stach with default installation Acessing Kibana with http does not mean that Elasticsearch is not using https, those are different tools with different settings. If you did the default installation according to the documentation, then Elasticsearch will have security enabled and https enabled. You can validate this looking into the `elasticsearch.yml` file, please share the content of `/etc/elasticsearch/elasticsearch.yml` file. ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 8:27pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/9 "2023-09-28T20:27:36Z")
this is my config ```auto ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # cluster.name: wwwhhhd # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: node-1 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # By default Elasticsearch is only accessible on localhost. Set a different # address here to expose this node on the network: # network.host: 0.0.0.0 # # By default Elasticsearch listens for HTTP traffic on the first free port it # finds starting at 9200. Set a specific HTTP port here: # #http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when this node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.seed_hosts: ["host1", "host2"] #discovery.type: single-node # # Bootstrap the cluster using an initial set of master-eligible nodes: # #cluster.initial_master_nodes: ["node-1", "node-2"] # # For more information, consult the discovery and cluster formation module documentation. # # ---------------------------------- Various ----------------------------------- # # Allow wildcard deletion of indices: # #action.destructive_requires_name: false #----------------------- BEGIN SECURITY AUTO CONFIGURATION ----------------------- # # The following settings, TLS certificates, and keys have been automatically # generated to configure Elasticsearch security features on 27-09-2023 10:54:52 # # -------------------------------------------------------------------------------- # Enable security features xpack.security.enabled: true xpack.security.enrollment.enabled: true # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 # Create a new cluster with the current node only # Additional nodes can still join the cluster later cluster.initial_master_nodes: ["uid_log"] # Allow HTTP API connections from anywhere # Connections are encrypted and require user authentication http.host: 0.0.0.0 # Allow other nodes to join the cluster from anywhere # Connections are encrypted and mutually authenticated #transport.host: 0.0.0.0 #----------------------- END SECURITY AUTO CONFIGURATION -- ``` on main server I install elasticsearch and kibana and logstash and other server I install onlty filebeate ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 28, 2023, 8:33pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/10 "2023-09-28T20:33:53Z")
> [@Mostafa\_Faridi](#): > > ```auto > xpack.security.http.ssl: > enabled: true > > ``` With this config, Elasticsearch is running with https, so you need to configure it in Logstash as well. You need to use `https://localhost:9200` in your logstash output, if your logstash is on the same server of your elasticsearch. You will also need to provide a user and a password. ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 8:37pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/11 "2023-09-28T20:37:07Z")
Thanks, Can you explain it more? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 28, 2023, 8:41pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/12 "2023-09-28T20:41:00Z")
You have security enable in Elasticsearch, so your Logstash will need to authenticate to be able to send data. You didn't provide any information if you create a user for it or not, but you will need to add a user and a password in your output. Something like this: ```auto user => username password => password ``` I recommend that you read this [documentation](https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-security). ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 28, 2023, 8:51pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/13 "2023-09-28T20:51:19Z")
I put user name and password of elastic user in ```auto /etc/logstash/conf.d/beats.conf ``` but I see that error again ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 28, 2023, 11:06pm UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/14 "2023-09-28T23:06:30Z")
> [@Mostafa\_Faridi](#): > > but I see that error again If you changed it to `https://localhost:9200` and added user and password you cannot have the same error, it would be a different error. Please share the log with the error you are receiving. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 29, 2023, 5:44am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/15 "2023-09-29T05:44:13Z")
What Leandro is talking: elasticsearch { hosts =\> ["http **s** ://localhost:9200"] ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 29, 2023, 8:01am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/16 "2023-09-29T08:01:43Z")
Thanks, sorry for late. I see this when I run systemctl status logstash ```auto ● logstash.service - logstash Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: deactivating (stop-sigterm) since Wed 2023-09-27 17:16:12 +0330; 1 day 18h ago Main PID: 9775 (java) Tasks: 43 CGroup: /system.slice/logstash.service └─9775 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev... Sep 29 11:20:14 iiii_log logstash[9775]: [2023-09-29T11:20:14,405][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exceptio...ed to respond>} Sep 29 11:20:14 iiii_log logstash[9775]: [2023-09-29T11:20:14,406][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:... Sep 29 11:20:19 iiii_log logstash[9775]: [2023-09-29T11:20:19,408][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exceptio...ed to respond>} Sep 29 11:20:19 iiii_log logstash[9775]: [2023-09-29T11:20:19,408][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:... Sep 29 11:20:24 iiii_log logstash[9775]: [2023-09-29T11:20:24,410][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exceptio...ed to respond>} Sep 29 11:20:24 iiii_log logstash[9775]: [2023-09-29T11:20:24,410][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:... Sep 29 11:20:29 iiii_log logstash[9775]: [2023-09-29T11:20:29,413][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exceptio...ed to respond>} Sep 29 11:20:29 iiii_log logstash[9775]: [2023-09-29T11:20:29,413][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:... Sep 29 11:20:34 iiii_log logstash[9775]: [2023-09-29T11:20:34,415][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exceptio...ed to respond>} Sep 29 11:20:34 iiii_log logstash[9775]: [2023-09-29T11:20:34,415][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:... Hint: Some lines were ellipsized, use -l to show in full. ``` this is my new config ```auto /etc/logstash/conf.d/beats.conf ``` in ```auto Mostafa Faridi 11:28 AM (0 minutes ago) to mostafafaridi input { beats { port => 5044 } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGLINE}" } } date { match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { elasticsearch { hosts => ["https://localhost:9200"] index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" user => "elastic" password => "fjdjfjdfjdhhfdjhfdjdsfjdhjie" } } ``` and I see this logs ```auto [2023-09-29T11:29:59,733][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:29:59,734][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-29T11:30:04,736][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:30:04,736][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-29T11:30:09,738][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:30:09,739][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-29T11:30:14,741][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:30:14,741][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-29T11:30:19,744][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:30:19,744][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [2023-09-29T11:30:24,746][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"localhost:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T11:30:24,747][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::ClientProtocolException] localhost:9200 failed to respond"} ^C ``` Do I need config somethings in ? ```auto /etc/logstash/logstash.yml ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 29, 2023, 8:52am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/17 "2023-09-29T08:52:08Z")
`url=>"http://localhost:9200/"` It's still HTTP, pls restart the LS service ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 29, 2023, 9:04am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/18 "2023-09-29T09:04:30Z")
I check , one process for logstash was running and I kill it by kill -9 and start LS, but I see these ```auto 2023-09-29T12:37:22,612][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:22,615][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-09-29T12:37:27,661][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:27,675][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-09-29T12:37:32,732][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:32,733][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-09-29T12:37:37,763][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:37,764][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-09-29T12:37:42,795][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:42,796][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-09-29T12:37:47,825][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-09-29T12:37:47,829][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@localhost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 29, 2023, 9:09am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/19 "2023-09-29T09:09:56Z")
For reloading .conf files, you can set params in logstash.yml ```auto config.reload.automatic: true config.reload.interval: 10s # the default interval is 3 sec. ``` > unable to find valid certification path to requested target [Go up](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/6) and set correctly. ---
**Author:** ![Mostafa\_Faridi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mostafa_faridi/32/121792_2.png) [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Post date:** [September 29, 2023, 9:34am UTC](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082/20 "2023-09-29T09:34:59Z")
Thanks, after change I see new errors ```auto tail -f /var/log/logstash/logstash-plain.log [2023-09-29T13:02:13,392][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"8.10.2", "jruby.version"=>"jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.8+7 on 17.0.8+7 +indy +jit [x86_64-linux]"} [2023-09-29T13:02:13,394][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2023-09-29T13:02:14,440][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false} [2023-09-29T13:02:14,477][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 22, column 17 (byte 375) after output {\n elasticsearch {\n hosts => [\"https://localhost:9200\"]\n index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n ssl_enabled ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:931:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:49:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]} [2023-09-29T13:02:14,510][INFO][logstash.runner] Logstash shut down. [2023-09-29T13:02:14,515][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:795) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:758) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?] [2023-09-29T13:03:03,410][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties [2023-09-29T13:03:03,512][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"8.10.2", "jruby.version"=>"jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.8+7 on 17.0.8+7 +indy +jit [x86_64-linux]"} [2023-09-29T13:03:03,518][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2023-09-29T13:03:05,815][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 22, column 17 (byte 375) after output {\n elasticsearch {\n hosts => [\"https://localhost:9200\"]\n index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n ssl_enabled ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:931:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:49:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]} [2023-09-29T13:03:05,881][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false} [2023-09-29T13:03:05,890][INFO][logstash.runner] Logstash shut down. [2023-09-29T13:03:05,897][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:795) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:758) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?] ``` [Next page](https://discuss.elastic.co/t/i-see-this-error-in-logstash-plain-log/344082.md?page=2)