# Issue after install Logstash on Mac OS

**URL:** <https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028>\
**Category:** Logstash\
**Created:** [September 13, 2021, 8:47am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028 "2021-09-13T08:47:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [September 13, 2021, 8:47am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028/1 "2021-09-13T08:47:35Z")

</div>

Hi I've met some problem within run Logstash on Mac also I've have followed by all commands and at least try to up Logstash instance by (logstash -f /usr/local/etc/logstash/logstash.conf --path.settings=/usr/local/etc/logstash)  
I didn't change any entry in \*yml files  
What's wrong. Do You have any idea?

`[2021-09-13T10:37:37,931][ERROR][logstash.outputs.elasticsearch][main] Unable to get license information {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '400' contacting Elasticsearch at URL 'http://127.0.0.1:9200/_license'"}`

`
[2021-09-13T10:37:37,932][ERROR][logstash.outputs.elasticsearch][main] Could not connect to a compatible version of Elasticsearch {:url=>"http://127.0.0.1:9200/"}
[2021-09-13T10:37:42,944][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://127.0.0.1:9200/"}
[2021-09-13T10:37:42,950][ERROR][logstash.outputs.elasticsearch][main] Unable to get license information {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '400' contacting Elasticsearch at URL 'http://127.0.0.1:9200/_license'"}`

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [September 13, 2021, 8:49am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028/2 "2021-09-13T08:49:22Z")

</div>

this is my config file

```auto
input {
  file {
    path => ["/var/log/*.log", "/var/log/messages", "/var/log/syslog"]
    type => "syslog"
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
  elasticsearch {
    hosts => ["127.0.0.1:9200"]
    index => "syslog-demo"
  }
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 13, 2021, 2:19pm UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028/3 "2021-09-13T14:19:16Z")

</div>

How did you install Elasticsearch and Logstash?

And which versions and which distribution?

What is the output of

`curl 127.0.0.1:9200`

---

<div class="post-metadata">

**Author:** ![INS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ins/32/92827_2.png) [@INS](https://discuss.elastic.co/u/INS)\
**Post date:** [September 27, 2021, 9:09am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028/4 "2021-09-27T09:09:08Z")

</div>

we can close this case I've reinstall this instance and it was passed

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2021, 9:09am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028/5 "2021-10-25T09:09:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.