Log stash pipeline not connecting to Elasticsearch

Elastic Stack Logstash
1

HI, I am getting below error while establishing connection from logstash pipeline to Elasticsearch.

I am able to do the telnet from logstash server to Elasticsearch server but not able to establish the connection.

logstash.conf file -
input {
stdin{}
}

output {
Elasticsearch {
hosts => ["10.128.0.3:9200"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}

Error message -

Elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::Elasticsearch", :hosts=>["//10.128.0.3:9200"]}
[INFO ] 2022-06-15 11:39:43.115 [[main]-pipeline-manager] Elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[http://10.128.0.3:9200/]}}
[ERROR] 2022-06-15 11:39:43.687 [[main]-pipeline-manager] javapipeline - Pipeline error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: Could not connect to a compatible version of Elasticsearch>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/outputs/Elasticsearch/http_client/pool.rb:245:in block in healthcheck!'", "org/jruby/RubyHash.java:1415:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/outputs/Elasticsearch/http_client/pool.rb:238:in healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:370:in update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/outputs/Elasticsearch/http_client/pool.rb:87:in update_initial_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:81:in start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/outputs/Elasticsearch/http_client.rb:358:in build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client.rb:63:in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/outputs/Elasticsearch/http_client_builder.rb:106:in create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:102:in build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-Elasticsearch-11.4.1-java/lib/logstash/plugin_mixins/Elasticsearch/common.rb:34:in build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.4.1-java/lib/logstash/outputs/elasticsearch.rb:279:in register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:233:in block in register_plugins'", "org/jruby/RubyArray.java:1821:in each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:232:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:598:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:245:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:190:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:142:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/beats.conf"], :thread=>"#<Thread:0x6ed41164 run>"}
[INFO ] 2022-06-15 11:39:43.691 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}
[ERROR] 2022-06-15 11:39:43.719 [Converge PipelineAction::Create] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[INFO ] 2022-06-15 11:39:43.843 [LogStash::Runner] runner - Logstash shut down.

2

If you do a get to that URL, you will get JSON back which includes things like the the minimum version that is wire protocol compatible. Generally you need logstash and elasticsearch to be the same version, or very close thereto.

See this thread.

1 Like
3

HI Dadger, Yes this is because of version mismatch. NOw issue is resolved., Thank you .

4

In future, please don't start more than one topic for your question, it makes it harder for people to help :slight_smile:

1 Like