# Logstash elasticsearch error with x pack

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556>\
**Category:** Logstash\
**Created:** [June 15, 2017, 12:43pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556 "2017-06-15T12:43:56Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 12:43pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/1 "2017-06-15T12:43:56Z")

</div>

Hi..  
Can anyone help me in solving this error .. I have been trying to solve this for four days .. I am new to ELK stack so.  
I have installed x pack in my ELK stack . Elasticsearch and kibana is working fine but when I start logstash .. it gives error.

Error is ---\>

> 

Sending Logstash's logs to /home/mywavia/Downloads/logstash-5.4.0/logs which is now configured via log4j2.properties  
[2017-06-15T17:47:46,298][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, { at line 2, column 5 (byte 12) after input{\nuser"}  
[2017-06-15T17:47:46,457][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)]}}  
[2017-06-15T17:47:46,459][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-15T17:47:46,539][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x24fdc5c0 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
[2017-06-15T17:47:46,543][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::HTTP:0x4b36ded0 URL:[http://localhost:9200](http://localhost:9200)\>]}  
[2017-06-15T17:47:46,548][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)]}}  
[2017-06-15T17:47:46,548][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-15T17:47:46,554][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x428d0f5e URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
[2017-06-15T17:47:46,560][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::HTTP:0x71a65ef2 URL:[http://localhost:9200](http://localhost:9200)\>]}  
[2017-06-15T17:47:46,563][INFO][logstash.pipeline] Starting pipeline {"id"=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>2}  
[2017-06-15T17:47:46,565][INFO][logstash.pipeline] Pipeline .monitoring-logstash started  
[2017-06-15T17:47:46,596][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-06-15T17:47:51,545][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-15T17:47:51,557][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0xc2f02d5 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
[2017-06-15T17:47:51,564][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-15T17:47:51,569][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x6e23bc14 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
^C[2017-06-15T17:47:53,846][WARN][logstash.runner] SIGINT received. Shutting down the agent.  
[2017-06-15T17:47:53,862][WARN][logstash.agent] stopping pipeline {:id=\>".monitoring-logstash"}  
^C[2017-06-15T17:47:54,052][FATAL][logstash.runner] SIGINT received. Terminating immediately..

In my logstash.yml file .. I have set

> Http:host "xx.xx.xx.xx:9200"

I have appended these line into logstash.yml --\>

> 

xpack.monitoring.enabled: true  
xpack.monitoring.elasticsearch.url: [http://master:9200](http://master:9200)

in elasticsearch.yml ...

> network.host xx.xx.xx.xx (same IP )

my config file is -

> 

input{  
user=\> elastic  
password =\> changeme  
stdin {}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}  
}  
geoip {  
source =\> "clientip"  
}  
}  
output {  
elasticsearch { hosts=\>["master"]  
user =\> elastic  
password =\> chageme  
}  
stdout { }  
}

Can you help me with this .. I don't understand why logstash is checking health of elasticsearch at localhost:9200 .'I haven't mentioned localhost anywhere neither in logstash.yml nor in elasticsearch.yml .

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 15, 2017, 12:56pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/2 "2017-06-15T12:56:32Z")

</div>

> [@raghvendra](#):
>
> input{  
> user=\> elastic  
> password =\> changeme  
> stdin {}  
> }

Remove `user` and `password` from the input section.

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 1:00pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/3 "2017-06-15T13:00:39Z")

</div>

i did ... now trash is -

> Sending Logstash's logs to /home/mywavia/Downloads/logstash-5.4.0/logs which is now configured via log4j2.properties  
> [2017-06-15T18:27:45,022][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)]}}  
> [2017-06-15T18:27:45,025][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
> [2017-06-15T18:27:45,122][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0xb245156 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
> [2017-06-15T18:27:45,136][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::HTTP:0x2159323e URL:[http://localhost:9200](http://localhost:9200)\>]}  
> [2017-06-15T18:27:45,137][INFO][logstash.pipeline] Starting pipeline {"id"=\>".monitoring-logstash", "pipeline.workers"=\>1, "pipeline.batch.size"=\>2, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>2}  
> [2017-06-15T18:27:45,140][INFO][logstash.pipeline] Pipeline .monitoring-logstash started  
> [2017-06-15T18:27:45,170][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://elastic:xxxxxx@master:9200/](http://elastic:xxxxxx@master:9200/)]}}  
> [2017-06-15T18:27:45,172][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://elastic:xxxxxx@master:9200/](http://elastic:xxxxxx@master:9200/), :path=\>"/"}  
> [2017-06-15T18:27:45,272][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x7b7c883d URL:[http://elastic:xxxxxx@master:9200/](http://elastic:xxxxxx@master:9200/)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://master:9200/](http://master:9200/)'"}  
> [2017-06-15T18:27:45,273][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
> [2017-06-15T18:27:45,353][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=\>"Got response code '401' contacting Elasticsearch at URL '[http://master:9200/](http://master:9200/)'", :class=\>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=\>["/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:76:in `perform_request'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in `perform\_request\_to\_url'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:273:in `perform_request'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:363:in `with\_connection'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:272:in `perform_request'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:280:in `get'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:83:in `get_version'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:16:in `get\_es\_version'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/template\_manager.rb:20:in `get_es_major_version'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:7:in `install\_template'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/common.rb:54:in `install_template'", "/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.3.0-java/lib/logstash/outputs/elasticsearch/common.rb:21:in `register'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/output\_delegator\_strategies/shared.rb:9:in `register'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/output_delegator.rb:41:in `register'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:268:in `register_plugin'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:279:in `register\_plugins'", "org/jruby/RubyArray.java:1613:in `each'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:279:in `register\_plugins'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:288:in `start_workers'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:214:in `run'", "/home/mywavia/Downloads/logstash-5.4.0/logstash-core/lib/logstash/agent.rb:398:in `start\_pipeline'"]}  
> [2017-06-15T18:27:45,354][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::Generic:0x152930e7 URL://master\>]}  
> [2017-06-15T18:27:45,392][INFO][logstash.filters.geoip] Using geoip database {:path=\>"/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/vendor/GeoLite2-City.mmdb"}

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 1:08pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/4 "2017-06-15T13:08:00Z")

</div>

Error code 401

> [2017-06-15T18:34:26,484][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x77e87b7c URL:[http://elastic:xxxxxx@master:9200/](http://elastic:xxxxxx@master:9200/)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://master:9200/](http://master:9200/)'"}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 15, 2017, 1:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/5 "2017-06-15T13:49:08Z")

</div>

> [@raghvendra](#):
>
> elasticsearch { hosts=\>["master"]

Does `master` resolve to a valid IP address?

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 1:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/6 "2017-06-15T13:49:56Z")

</div>

@Christian_Dahlqvist  
yes I have edited hosts file ...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 15, 2017, 1:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/7 "2017-06-15T13:52:58Z")

</div>

> [@raghvendra](#):
>
> [2017-06-15T18:27:45,172][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://elastic:xxxxxx@master:9200/](http://elastic:xxxxxx@master:9200/), :path=\>"/"}  
> [2017-06-15T18:27:45,272][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://master:9200/](http://master:9200/)'"}

It looks like Logstash is not able to connect to Elasticsearch.

> [@raghvendra](#):
>
> chageme

Should this perhaps be the default password `changeme`?

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 1:59pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/8 "2017-06-15T13:59:23Z")

</div>

yes ...it's default .. I have updated password .. now it is showing this error -\>

> [2017-06-15T19:27:15,900][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://elastic:xxxxxx@192.168.2.156:9200/](http://elastic:xxxxxx@192.168.2.156:9200/), :path=\>"/"}  
> [2017-06-15T19:27:15,916][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x3666e1d0 URL:[http://elastic:xxxxxx@192.168.2.156:9200/](http://elastic:xxxxxx@192.168.2.156:9200/)\>}  
> [2017-06-15T19:27:15,918][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
> [2017-06-15T19:27:15,947][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
> [2017-06-15T19:27:15,952][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::Generic:0xac6d98e URL://192.168.2.156:9200\>]}  
> [2017-06-15T19:27:15,976][INFO][logstash.filters.geoip] Using geoip database {:path=\>"/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/vendor/GeoLite2-City.mmdb"}  
> [2017-06-15T19:27:15,986][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250}  
> [2017-06-15T19:27:16,003][INFO][logstash.pipeline] Pipeline main started  
> The stdin plugin is now waiting for input:  
> [2017-06-15T19:27:16,036][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
> [2017-06-15T19:27:20,865][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
> [2017-06-15T19:27:20,877][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
> [2017-06-15T19:27:20,876][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x419b8dd3 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}  
> [2017-06-15T19:27:20,893][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x61a452e8 URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 15, 2017, 2:18pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/9 "2017-06-15T14:18:57Z")

</div>

> [@raghvendra](#):
>
> [2017-06-15T19:27:20,876][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}

It looks like Logstash is trying to connect to `localhost`, not `master`. Where did you specify to connect as the user `logstash_system`?

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 15, 2017, 2:20pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/10 "2017-06-15T14:20:41Z")

</div>

I guess nowhere .. where I have to do so ??

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 16, 2017, 7:29am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/11 "2017-06-16T07:29:54Z")

</div>

@Christian_Dahlqvist.  
I have tried same thing after disabling x pack security in each node of elasticsearch.yml and kibana.yml and logstash.yml . I removed username and password credentials from output section of config file .

but it's still giving the same error

> 

[2017-06-16T12:53:45,483][INFO][logstash.pipeline] Pipeline .monitoring-logstash started  
[2017-06-16T12:53:45,517][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://master:9200/](http://master:9200/), [http://slave-1:9200/](http://slave-1:9200/), [http://slave-2:9200/](http://slave-2:9200/)]}}  
[2017-06-16T12:53:45,519][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://master:9200/](http://master:9200/), :path=\>"/"}  
[2017-06-16T12:53:45,548][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x67141a10 URL:[http://master:9200/](http://master:9200/)\>}  
[2017-06-16T12:53:45,548][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://slave-1:9200/](http://slave-1:9200/), :path=\>"/"}  
[2017-06-16T12:53:45,553][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x5276d542 URL:[http://slave-1:9200/](http://slave-1:9200/)\>}  
[2017-06-16T12:53:45,554][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://slave-2:9200/](http://slave-2:9200/), :path=\>"/"}  
[2017-06-16T12:53:45,561][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x4ebe9e92 URL:[http://slave-2:9200/](http://slave-2:9200/)\>}  
[2017-06-16T12:53:45,563][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2017-06-16T12:53:45,659][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2017-06-16T12:53:45,671][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::Generic:0x1fdf3a17 URL://master\>, #\<URI::Generic:0x211087cc URL://slave-1\>, #\<URI::Generic:0x56cb1814 URL://slave-2\>]}  
[2017-06-16T12:53:45,716][INFO][logstash.filters.geoip] Using geoip database {:path=\>"/home/mywavia/Downloads/logstash-5.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/vendor/GeoLite2-City.mmdb"}  
[2017-06-16T12:53:45,738][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250}  
[2017-06-16T12:53:45,756][INFO][logstash.pipeline] Pipeline main started  
The stdin plugin is now waiting for input:  
[2017-06-16T12:53:45,850][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-06-16T12:53:50,470][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-16T12:53:50,475][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}  
[2017-06-16T12:53:50,497][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#\<URI::HTTP:0x5b11fc1c URL:[http://logstash\_system:xxxxxx@localhost:9200/\_xpack/monitoring/?system\_id=logstash&system\_api\_version=2&interval=1s](http://logstash_system:xxxxxx@localhost:9200/_xpack/monitoring/?system_id=logstash&system_api_version=2&interval=1s)\>, :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}

---

<div class="post-metadata">

**Author:** ![raghvendra](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@raghvendra](https://discuss.elastic.co/u/raghvendra)\
**Post date:** [June 16, 2017, 7:45am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/12 "2017-06-16T07:45:51Z")

</div>

By the way ... in spite of these warning it's working fine . logstash is pumping data into ES and I can visualize it through kibana . But what about these warnings ??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2017, 7:46am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-error-with-x-pack/89556/13 "2017-07-14T07:46:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.