Issue with connection message=>"no address for stream.twitter.com"

[Mir_S]

Hi

I have an issue with the input twitter plugin:
I'm using the official logstash docker container 6.1.3 from elastic . Created a Basic Pipelinefile as follow:

input {
twitter {
id => "id1"
consumer_key => ""
consumer_secret => ""
oauth_token => ""
oauth_token_secret => ""
keywords => ["news"]
languages => ["en", "de"]
}
}

output {
mongodb {
id => "id2"
uri => "mongodb://xxxx:27017"
database => "news"
collection => "tweets"
}
}

But when I start logstash I get the following error for this pipeline file:

[2018-02-01T09:02:54,649][WARN ][logstash.inputs.twitter ] Twitter client error {:message=>"no address for stream.twitter.com", :exception=>"Resolv::ResolvError", :backtrace=>["/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/resolv.rb:101:in getaddress'", "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/resolv.rb:51:ingetaddress'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-twitter-3.0.7/lib/logstash/inputs/twitter/patches.rb:26:in stream'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-twitter-3.0.7/lib/logstash/inputs/twitter/patches.rb:58:inrequest'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/twitter-5.15.0/lib/twitter/streaming/client.rb:37:in filter'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-twitter-3.0.7/lib/logstash/inputs/twitter.rb:138:inrun'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:524:in inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:517:inblock in start_input'"], :options=>nil}

Did somebody have an idea what I have to change to get this working.
We are not behind a proxy. A ping from the docker host pc to stream.twitter.com resolves the address just fine.

Thanks for your help.
BR

[Mir_S]

I have identified the issue. It depends on the docker swarm mode. But I have no idea to solve it.

If I run the container as "plain" docker container on the same host, than it works just fine. But If I include this in a stack (docker swarm service) with own overlay network this failure comes up.

Has somebody an idea how to change this or have the services:
My stack configuration is:
version: '3'

logstash:
image: docker.elastic.co/logstash/logstash:6.1.3
volumes:
- /mnt/gluster/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
- /mnt/gluster/logstash/pipelines/:/usr/share/logstash/pipeline
networks:
- logstash
environment:
xpack.monitoring.enabled: "false"
deploy:
replicas: 1
placement:
constraints:
- node.role == worker same issue with swarm mode.

networks:
logstash:
external: true

Thanks for your help.
BR