# Logstash Doesnt Connect to ES Cluster after enabling Xpack **URL:** \ **Category:** Logstash\ **Created:** [November 6, 2019, 1:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-connect-to-es-cluster-after-enabling-xpack/206800 "2019-11-06T13:47:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sudhirjunonikar](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@sudhirjunonikar](https://discuss.elastic.co/u/sudhirjunonikar)\ **Post date:** [November 6, 2019, 1:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-connect-to-es-cluster-after-enabling-xpack/206800/1 "2019-11-06T13:47:14Z")
Hi, Please help to identify the configuration issue of Logstash, the Stack version is 7.4.0 Logstash stopped working after enabling xpack. It is three node cluster and it is up. Logstash Debug shows following error, there are two errors 1. [2019-11-06T17:52:48,070][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=\>"Use either "cacert" or "truststore" when configuring the CA certificate"} 2. [2019-11-06T17:53:04,877][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://115.110.89.12:9200/](http://115.110.89.12:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://115.110.89.12:9200/](http://115.110.89.12:9200/)][Manticore::ClientProtocolException] 115.110.89.12:9200 failed to respond"} Here is output section of logstash.conf file. * * * output { if [type] == "esxisyslog" { elasticsearch { hosts =\> ["115.110.89.12:9200"] ssl =\> true cacert =\> '/etc/logstash/elastic-certificates.p12' user =\> "elastic" password =\> "xxxx" index =\> "prod-esxi-syslogs-%{+YYYY.MM}" } else if [type] == "unixsyslog" { elasticsearch { hosts =\> ["115.110.89.12:9200"] ssl =\> true cacert =\> '/etc/logstash/elastic-certificates.p12' user =\> "elastic" password =\> "xxxxx" ``` index => "prod-linux-syslogs-%{+YYYY.MM}" } ``` } stdout {codec =\> rubydebug} } * * * 1. Here is logstash.yml file configuration for xpack monitoring ########################################################### # X-Pack Monitoring # [https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html](https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html) xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.username: logstash\_system xpack.monitoring.elasticsearch.password: Pass@123 xpack.monitoring.elasticsearch.hosts: ["[http://115.110.89.12:9200](http://115.110.89.12:9200)"] xpack.monitoring.elasticsearch.ssl.verification\_mode: certificate xpack.monitoring.elasticsearch.ssl.certificate\_authority: /etc/logstash/elastic-certificates.p12 xpack.monitoring.elasticsearch.ssl.truststore.path: /etc/logstash/elastic-stack-ca.p12 #xpack.monitoring.elasticsearch.ssl.truststore.password: password #xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file #xpack.monitoring.elasticsearch.ssl.keystore.password: password #xpack.monitoring.elasticsearch.ssl.verification\_mode: certificate #xpack.monitoring.elasticsearch.sniffing: false #xpack.monitoring.collection.interval: 10s #xpack.monitoring.collection.pipeline.details.enabled: true # # X-Pack Management # [https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html](https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html) #xpack.management.enabled: false #xpack.management.pipeline.id: ["main", "apache\_logs"] #xpack.management.elasticsearch.username: logstash\_admin\_user #xpack.management.elasticsearch.password: P@ssword #xpack.management.elasticsearch.hosts: ["[https://115.110.89.12:9200](https://115.110.89.12:9200)", "[https://115.110.89.18:9200](https://115.110.89.18:9200)", "[https://115.110.89.51](https://115.110.89.51)"] #xpack.management.elasticsearch.ssl.certificate\_authority: ["/path/to/ca.crt"] #xpack.management.elasticsearch.ssl.truststore.path: /path/to/file #xpack.management.elasticsearch.ssl.truststore.password: password #xpack.management.elasticsearch.ssl.keystore.path: /path/to/file #xpack.management.elasticsearch.ssl.keystore.password: password #xpack.management.elasticsearch.ssl.verification\_mode: certificate #xpack.management.elasticsearch.sniffing: false #xpack.management.logstash.poll\_interval: 5s * * * 1. xpack configuration in elasticsearch.yml file ########################################################### xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12 ############################################################ ---
**Author:** ![lmh89](https://avatars.discourse-cdn.com/v4/letter/l/ea666f/32.png) [@lmh89](https://discuss.elastic.co/u/lmh89)\ **Post date:** [November 28, 2019, 9:43am UTC](https://discuss.elastic.co/t/logstash-doesnt-connect-to-es-cluster-after-enabling-xpack/206800/2 "2019-11-28T09:43:16Z")
I have the question,too MY version is 7.4.2 and I alse don't why ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 26, 2019, 9:43am UTC](https://discuss.elastic.co/t/logstash-doesnt-connect-to-es-cluster-after-enabling-xpack/206800/3 "2019-12-26T09:43:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.