# Logstash arcsight integration module (problem)

**URL:** <https://discuss.elastic.co/t/logstash-arcsight-integration-module-problem/139161>\
**Category:** Logstash\
**Created:** [July 9, 2018, 11:56am UTC](https://discuss.elastic.co/t/logstash-arcsight-integration-module-problem/139161 "2018-07-09T11:56:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tsm-elastic](https://avatars.discourse-cdn.com/v4/letter/t/e9a140/32.png) [@tsm-elastic](https://discuss.elastic.co/u/tsm-elastic)\
**Post date:** [July 9, 2018, 11:56am UTC](https://discuss.elastic.co/t/logstash-arcsight-integration-module-problem/139161/1 "2018-07-09T11:56:32Z")

</div>

Hi, I am currently setting up the ArcSight integration module on Logstash so that I could feed security logs to the elastic stack via smartconnectors. Here's the config I am using as instructed in the guide:

bin/logstash --modules arcsight --setup   
-M "arcsight.var.input.smartconnector.bootstrap\_servers=10.132.111.24:56743"   
-M "arcsight.var.elasticsearch.hosts=10.170.41.180:9200"   
-M "arcsight.var.kibana.host=10.170.41.180:5601"

Upon checking tcpdumps, i am able to receive the logs from the smart connections but I am receiving this error:

[WARN] 2018-07-09 19:51:03.834 [Ruby-0-Thread-13: :1] NetworkClient - [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 could not be established. Broker may not be available.  
[WARN] 2018-07-09 19:51:04.787 [Ruby-0-Thread-13: :1] NetworkClient - [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 could not be established. Broker may not be available.  
[WARN] 2018-07-09 19:51:05.941 [Ruby-0-Thread-13: :1] NetworkClient - [Consumer clientId=logstash-0, groupId=logstash] Connection to node -1 could not be established. Broker may not be available.

tcpdump for reference:  
19:55:55.735831 IP 10.132.111.24 \> cydo-elastic: udp  
19:55:55.735880 IP 10.132.111.24.56743 \> cydo-elastic.5000: UDP, length 1299  
19:55:55.735981 IP 10.132.111.24.56743 \> cydo-elastic.5000: UDP, length 1179  
19:55:55.736099 IP 10.132.111.24.56743 \> cydo-elastic.5000: UDP, length 1164  
19:55:55.736229 IP 10.132.111.24.56743 \> cydo-elastic.5000: UDP, length 1277

Also, i am running on version 6.3 of ELK

Any ideas on how to fix this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2018, 11:56am UTC](https://discuss.elastic.co/t/logstash-arcsight-integration-module-problem/139161/2 "2018-08-06T11:56:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.