# Logstash connection to elasticsearch **URL:** \ **Category:** Logstash\ **Created:** [August 30, 2017, 1:06am UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768 "2017-08-30T01:06:40Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rogerscuall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rogerscuall/32/21633_2.png) [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Post date:** [August 30, 2017, 1:06am UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/1 "2017-08-30T01:06:40Z")
I'm using the official docker containers for elasticsearch and logstash and following for the most part the configuration in this website, but I'm having problem with logstash connecting to elasticsearch. The output of logstash is like this: > [2017-08-30T00:28:59,105][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@elasticsearch:9200/](http://logstash_system:xxxxxx@elasticsearch:9200/), :path=\>"/"} > [2017-08-30T00:28:59,109][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://logstash\_system:xxxxxx@elasticsearch:9200/](http://logstash_system:xxxxxx@elasticsearch:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@elasticsearch:9200/](http://logstash_system:xxxxxx@elasticsearch:9200/)][Manticore::ResolutionFailure] elasticsearch"} I was looking in the discussions here and for the most part that is a a network issue, but is not in my case: > ➜ ~ docker exec -it 6a0b92a7d911 curl -u elastic [http://es:9200](http://es:9200) > Enter host password for user 'elastic': > { > "name" : "iSqmies", > "cluster\_name" : "docker-cluster", > "cluster\_uuid" : "odHu\_VZcRYK90ykh1ywJ-Q", > "version" : { > "number" : "5.5.2", > "build\_hash" : "b2f0c09", > "build\_date" : "2017-08-14T12:33:14.154Z", > "build\_snapshot" : false, > "lucene\_version" : "6.6.0" > }, > "tagline" : "You Know, for Search" The previous output is from the logstash container connecting to the elasticsearch. The configuration of logstash is really basic: > input { stdin { } } > output { > elasticsearch { > hosts =\> ["es:9200"] > user =\> elastic > password =\> changeme > } > stdout { codec =\> rubydebug } > } Absolutely no change in the config of elasticsearch. Let me know if you have any idea of what is happening. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 30, 2017, 5:13am UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/2 "2017-08-30T05:13:58Z")
Why does the log talk about [http://logstash\_system:xxxxxx@elasticsearch:9200/](http://logstash_system:xxxxxx@elasticsearch:9200/) when your configuration indicates [http://elastic:xxxxxx@es:9200/](http://elastic:xxxxxx@es:9200/)? ---
**Author:** ![poojagupta](https://avatars.discourse-cdn.com/v4/letter/p/5daacb/32.png) [@poojagupta](https://discuss.elastic.co/u/poojagupta)\ **Post date:** [August 30, 2017, 10:05am UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/3 "2017-08-30T10:05:11Z")
logs are pointing to [http://logstash\_system:xxxxxx@elasticsearch:9200/](http://logstash_system:xxxxxx@elasticsearch:9200/) check your configuration file for your input plugin . for ex: if using filebeat there is filebeat.conf file in which output section is mentioned so comment out the elasticsearch section within it and uncomment the output.logtstash part and mention your logstash url. ---
**Author:** ![rogerscuall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rogerscuall/32/21633_2.png) [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Post date:** [August 30, 2017, 10:14pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/4 "2017-08-30T22:14:05Z")
Maybe I'm missing something here, I haven't got to that point yet, there is nothing sending information at this point the input is `stdin` I was trying just to establish configuration between both, the only configuration is: > input { stdin { } } > output { > elasticsearch { > hosts =\> [β€œes:9200”] > user =\> elastic > password =\> changeme > } > stdout { codec =\> rubydebug } > } And I'm using this as a test to verify communication between the containers/services. thanks. ---
**Author:** ![rogerscuall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rogerscuall/32/21633_2.png) [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Post date:** [August 30, 2017, 10:16pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/5 "2017-08-30T22:16:57Z")
I'm not entirely sure, I have used this services before but never with the official docker images you provide here, I know that there are some preconfigured options and I think one of those I haven't configured correctly and is creating this log. ---
**Author:** ![rogerscuall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rogerscuall/32/21633_2.png) [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Post date:** [August 30, 2017, 10:57pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/6 "2017-08-30T22:57:54Z")
First time I read your question I dont think I fully understood what you meant to say. So I started playing with two settings. 1. The name of the elasticsearch container using: "es" or "elasticsearch" 2. The host configuration on the config file, one more time using: "es" or "elasticsearch" The combination of using the name "es" for the elasticsearch container and config file, throws the log error: `http://logstash_system:xxxxxx@elasticsearch:9200/` The combination of using the name "elasticsearch" for the container and but using "es" in the config file, the error is: `http://elastic:xxxxxx@es:9200` Only when I use "elasticsearch" on both the container name and the config file everything works just fine. When I launch logstash I `link` the container to the elasticsearch running container. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 31, 2017, 5:12am UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/7 "2017-08-31T05:12:22Z")
I suspect it's the monitoring configuration in the logstash.yml found in the Docker image that's the culprit here. ---
**Author:** ![rogerscuall](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rogerscuall/32/21633_2.png) [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Post date:** [August 31, 2017, 7:49pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/8 "2017-08-31T19:49:04Z")
Yes you are right that is the problem, this is the config in `logstash.yml` ```auto http.host: "0.0.0.0" path.config: /usr/share/logstash/pipeline xpack.monitoring.elasticsearch.url: http://elasticsearch:9200 xpack.monitoring.elasticsearch.username: logstash_system xpack.monitoring.elasticsearch.password: changeme ``` So that configuration is hardcoded and if the hostname elasticsearch is not resolved that is going to throw and error. I could copy a new `logstash.yml` to the correct path during the creation of the container, any other idea of how to deal with this. I would like to do ELK using containers only. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2017, 7:49pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768/9 "2017-09-28T19:49:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.