Hi..
Can anyone help me in solving this error .. I have been trying to solve this for four days .. I am new to ELK stack so.
I have installed x pack in my ELK stack . Elasticsearch and kibana is working fine but when I start logstash .. it gives error.
Error is --->
Sending Logstash's logs to /home/mywavia/Downloads/logstash-5.4.0/logs which is now configured via log4j2.properties
[2017-06-15T17:47:46,298][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, { at line 2, column 5 (byte 12) after input{\nuser"}
[2017-06-15T17:47:46,457][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s]}}
[2017-06-15T17:47:46,459][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-06-15T17:47:46,539][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x24fdc5c0 URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-06-15T17:47:46,543][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::Elasticsearch", :hosts=>[#<URI::HTTP:0x4b36ded0 URL:http://localhost:9200>]}
[2017-06-15T17:47:46,548][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s]}}
[2017-06-15T17:47:46,548][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-06-15T17:47:46,554][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x428d0f5e URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-06-15T17:47:46,560][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::Elasticsearch", :hosts=>[#<URI::HTTP:0x71a65ef2 URL:http://localhost:9200>]}
[2017-06-15T17:47:46,563][INFO ][logstash.pipeline ] Starting pipeline {"id"=>".monitoring-logstash", "pipeline.workers"=>1, "pipeline.batch.size"=>2, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>2}
[2017-06-15T17:47:46,565][INFO ][logstash.pipeline ] Pipeline .monitoring-logstash started
[2017-06-15T17:47:46,596][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2017-06-15T17:47:51,545][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-06-15T17:47:51,557][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0xc2f02d5 URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
[2017-06-15T17:47:51,564][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@localhost:9200/, :path=>"/"}
[2017-06-15T17:47:51,569][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>#<URI::HTTP:0x6e23bc14 URL:http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s>, :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}
^C[2017-06-15T17:47:53,846][WARN ][logstash.runner ] SIGINT received. Shutting down the agent.
[2017-06-15T17:47:53,862][WARN ][logstash.agent ] stopping pipeline {:id=>".monitoring-logstash"}
^C[2017-06-15T17:47:54,052][FATAL][logstash.runner ] SIGINT received. Terminating immediately..
In my logstash.yml file .. I have set
Http:host "xx.xx.xx.xx:9200"
I have appended these line into logstash.yml -->
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.url: http://master:9200
in elasticsearch.yml ...
network.host xx.xx.xx.xx (same IP )
my config file is -
input{
user=> elastic
password => changeme
stdin {}
}
filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
geoip {
source => "clientip"
}
}
output {
elasticsearch { hosts=>["master"]
user => elastic
password => chageme
}
stdout { }
}
Can you help me with this .. I don't understand why logstash is checking health of elasticsearch at localhost:9200 .'I haven't mentioned localhost anywhere neither in logstash.yml nor in elasticsearch.yml .