Logstash (Center) connection refused (solved)

Elastic Stack Logstash
1

Hi All,

My logstash conf (center) setting as following, is it incorrect?

input {
        redis {
                host => "redis"
                port => 6379
                type => "redis-input"
                data_type => "list"
                key => "miki"
        }
}

output {
        stdout { codec => rubydebug }
                elasticsearch {
                        host => "elasticsearch"
                        codec => "json"
                        protocol => "http"
                        user => "es_admin"
                        password => "iiiiii"

                }
}

Found some errors like

> {:timestamp=>"2015-08-18T15:21:10.492000+0800", :message=>"Failed to flush outgoing items", :outgoing_count=>21, :exception=>#<Manticore::SocketException: Connection refused>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:35:in `initialize'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:61:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:225:in `call_once'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.1-java/lib/manticore/response.rb:128:in `code'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:71:in `perform_request'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/base.rb:190:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.12/lib/elasticsearch/transport/client.rb:119:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.12/lib/elasticsearch/api/actions/bulk.rb:80:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch/protocol.rb:103:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:505:in `submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:504:in `submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:529:in `flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.1-java/lib/logstash/outputs/elasticsearch.rb:528:in `flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:219:in `buffer_flush'", "org/jruby/RubyHash.java:1341:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:216:in `buffer_flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:112:in `buffer_initialize'", "org/jruby/RubyKernel.java:1511:in `loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.20/lib/stud/buffer.rb:110:in `buffer_initialize'"], :level=>:warn}
> {:timestamp=>"2015-08-18T15:21:11.497000+0800", :message=>"Got error to send bulk of actions: Connection refused", :level=>:error}

Jason

2

There's nobody answering on elasticsearch:9200 when Logstash tries to connect (or there's a firewall blocking the connections). Is Elasticsearch actually running on that host?

3

Hi Magnus,

Yes, elasticsearch actually running on my host,

[2015-08-18 17:10:46,246][INFO ][http                     ] [elknode] bound_address {inet[/0:0:0:0:0:0:0:0:9200]}, publish_address {inet[/140.92.25.126:9200]}
[2015-08-18 17:10:46,246][INFO ][node                     ] [elknode] started

All of the log(I am not sure) has been written to elasticsearch and I can search them by Kibana, but the connection refused error message has been printed everysecond in /var/log/logstash/logstash.log

4

What if you use host => "140.92.25.126"

5

Hi Mark,

It can be work, thanks