# Logstash error with elasticsearch output plugin - Unrecognized SSL message

**URL:** https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695
**Category:** Logstash
**Created:** [April 7, 2019, 3:30am UTC](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695 "2019-04-07T03:30:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)
#### Post date: [April 7, 2019, 3:30am UTC](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695/1 "2019-04-07T03:30:33Z")

</div>

Hello Team,

I am getting unrecognised SSL error when i use elasticsearch output pipeline in my logstash located in different machine.  
I am using another logstash in my elasticsearch machine and it is indexing data properly.

below is the error when i try to input either file or direct TCP ,

```
[2019-04-07T10:58:52,565][ERROR][logstash.pipeline] Error registering plugin {:pipeline_id=>"main", :plugin=>"#<LogStash::OutputDelegator:0x1295624d>", :error=>"Unrecognized SSL message, plaintext connection?", :thread=>"#<Thread:0x5a1c3d82 run>"}
[2019-04-07T10:58:52,572][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Manticore::UnknownException: Unrecognized SSL message, plaintext connection?>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:74:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:245:in `block in healthcheck!'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:241:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:341:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:71:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:302:in `build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:64:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:103:in `create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:99:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch.rb:238:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:25:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:106:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:48:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:611:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:280:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x5a1c3d82 run>"}
[2019-04-07T10:58:52,623][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

Below is my Logstash Conf file

```
    input {
      file {
       path => "/tmp/DARP-intel-output.json"
       codec => "json"
     }
    }
    output {
      elasticsearch {
        hosts => "https://192.168.56.10:9200"
        index => "threat-intel-%{+YYYY.MM.dd}"
      }
    }

```

Also I tried another type of Input but still same error.

```
input {
 tcp {
  port => 5514
  }
}
filter {
  # Tag minemeld events
  if "@origin" in [message] {
    mutate {
      add_tag => "minemeld"
    }
    json {
      source => "message"
    }
  }
}
output {
  elasticsearch {
    hosts => "https://192.168.56.10:9200"
    index => "threat-intel-%{+YYYY.MM.dd}"
    cacert => "/etc/nginx/minemeld.cer"
  }
}

```

This logstash is 6.7 and elasticsearch in other machine is 6.6.2 .

Kindly help me with troubleshooting this error.

---

<div class="post-metadata">

### Author: ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)
#### Post date: [April 7, 2019, 6:07am UTC](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695/2 "2019-04-07T06:07:46Z")

</div>

Hi All,

I fixed the issue . It was a simple mistake which confused so much.

I used http in output plugin instead of https.

my final config

```
input {
 tcp {
  port => 5514
  }
}
filter {
  # Tag minemeld events
  if "@origin" in [message] {
    mutate {
      add_tag => "minemeld"
    }
    json {
      source => "message"
    }
  }
}
output {
  elasticsearch {
    hosts => "http://192.168.56.10:9200"
    index => "logstash-threat-intel-%{+YYYY.MM.dd}"
    cacert => "/etc/nginx/minemeld.cer"
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2019, 6:07am UTC](https://discuss.elastic.co/t/logstash-error-with-elasticsearch-output-plugin-unrecognized-ssl-message/175695/3 "2019-05-05T06:07:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
