# Logstash doesn't communicate with Elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447>\
**Category:** Logstash\
**Created:** [February 5, 2018, 12:49pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447 "2018-02-05T12:49:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [February 5, 2018, 12:49pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/1 "2018-02-05T12:49:27Z")

</div>

Hi,

"I'm novice in Elastic Stack !!! "

My Elasticsearch and Kibana on Linux Ubuntu working well. I receive log from beats but my logstash seems to do not communicate with elasticsearch.

Logstash on my server shoud read directly log files on server.

Could you please help me.

Regards

my conf in /etc/logstash/conf.d is :

input {  
file {  
path =\> ["/var/log/\*"]  
type =\> "syslog"  
}  
}

filter {  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
stdout { codec =\> rubydebug { metadata =\> true }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 5, 2018, 1:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/2 "2018-02-05T13:47:00Z")

</div>

Is Logstash reading any logs at all? Comment out your elasticsearch filter and use only your stdout output to find out. Have you looked in your Logstash log for clues about any ES connection problems?

---

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [February 5, 2018, 2:29pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/3 "2018-02-05T14:29:24Z")

</div>

Thank you for replying.

I changed my conf into :

input {  
file {  
path =\> ["/var/log/\*"]  
type =\> "syslog"  
}  
}

filter {  
}

output {  
stdout { }  
}

but still noting happed.

in my log

/usr/share/logstash/logs/logstash-plain.log

I have repeatedly these two lines :

[2018-02-05T15:23:55,483][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"}

[2018-02-05T15:23:55,489][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"}

Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 5, 2018, 2:50pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/4 "2018-02-05T14:50:01Z")

</div>

Does the Logstash process have permissions to read the files in /var/log? Are those files changing at any point?

---

<div class="post-metadata">

**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Post date:** [February 6, 2018, 12:58pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/5 "2018-02-06T12:58:51Z")

</div>

Hi Magnus,

yes, I has the permission to read the logs.  
As the server is for Elastic Stack product validation, there is not lots of logs. But in any case, I should be able to see the old entries in Kibana.

could you please tell also me why I have repeaded logs in  
/usr/share/logstash/logs/logstash-plain.log

as folow :

[2018-02-06T11:57:10,664][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"}  
[2018-02-06T11:57:10,666][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"}

Which communication protocol is used between logstash and lesaticsearch ?

Many thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2018, 9:30pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/6 "2018-02-06T21:30:19Z")

</div>

> But in any case, I should be able to see the old entries in Kibana.

Not without `start_position => "beginning"` in the file input configuration.

> Which communication protocol is used between logstash and lesaticsearch ?

HTTP.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 9:30pm UTC](https://discuss.elastic.co/t/logstash-doesnt-communicate-with-elasticsearch/118447/7 "2018-03-06T21:30:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.