Logstash can not connect to Elasticsearch host

Hello!

so i recently made a new ES cluster and that is up and running fine. I start sending info to it via logstash and logstash can not connect to the ES host. here is the dump from the logstash log on the remote server (connected via VPN )

[2017-11-03T10:31:37,862][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2017-11-03T10:31:37,869][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2017-11-03T10:31:38,905][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://192.168.137.129:9200/]}}
[2017-11-03T10:31:38,908][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://192.168.137.129:9200/, :path=>"/"}
[2017-11-03T10:31:49,057][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://192.168.137.129:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://192.168.137.129:9200/][Manticore::ConnectTimeout] connect timed out"}
[2017-11-03T10:31:49,058][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2017-11-03T10:31:49,059][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Template file '' could not be found!", :class=>"ArgumentError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:37:in `read_template_file'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:23:in `get_template'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:7:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/common.rb:58:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.4.2-java/lib/logstash/outputs/elasticsearch/common.rb:25:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:43:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301:in `register_plugins'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:310:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:398:in `start_pipeline'"]}
[2017-11-03T10:31:49,060][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//192.168.137.129:9200"]}
[2017-11-03T10:31:49,118][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
[2017-11-03T10:31:49,290][INFO ][logstash.pipeline        ] Pipeline main started
[2017-11-03T10:31:49,295][INFO ][logstash.inputs.udp      ] Starting UDP listener {:address=>"0.0.0.0:5000"}
[2017-11-03T10:31:49,312][INFO ][logstash.inputs.udp      ] Starting UDP listener {:address=>"0.0.0.0:9000"}
[2017-11-03T10:31:49,316][INFO ][logstash.inputs.udp      ] UDP listener started {:address=>"0.0.0.0:5000", :receive_buffer_bytes=>"62464", :queue_size=>"2000"}
[2017-11-03T10:31:49,316][INFO ][logstash.inputs.udp      ] UDP listener started {:address=>"0.0.0.0:9000", :receive_buffer_bytes=>"62464", :queue_size=>"2000"}
[2017-11-03T10:31:49,332][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

[2017-11-03T10:32:16,111][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://192.168.137.129:9200/, :path=>"/"}
[2017-11-03T10:32:26,163][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://192.168.137.129:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://192.168.137.129:9200/][Manticore::ConnectTimeout] connect timed out"}
[2017-11-03T10:32:27,164][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://192.168.137.129:9200/, :path=>"/"}
[2017-11-03T10:32:27,346][WARN ][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://192.168.137.129:9200/][Manticore::ConnectTimeout] connect timed out {:url=>http://192.168.137.129:9200/, :error_message=>"Elasticsearch Unreachable: [http://192.168.137.129:9200/][Manticore::ConnectTimeout] connect timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[2017-11-03T10:32:27,347][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error_message=>"Elasticsearch Unreachable: [http://192.168.137.129:9200/][Manticore::ConnectTimeout] connect timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :will_retry_in_seconds=>2}
[2017-11-03T10:32:29,348][WARN ][logstash.outputs.elasticsearch] UNEXPECTED POOL ERROR {:e=>#<LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError: No Available connections>}
[2017-11-03T10:32:29,349][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch, but no there are no living connections in the connection pool. Perhaps Elasticsearch is unreachable or down? {:error_message=>"No Available connections", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError", :will_retry_in_seconds=>4}

any help is appreciated

Did you check if elasticsearch is running ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.