# Logstash-filebeat error

**URL:** <https://discuss.elastic.co/t/logstash-filebeat-error/46315>\
**Category:** Logstash\
**Created:** [April 5, 2016, 1:48am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315 "2016-04-05T01:48:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Farouk\_Samu](https://avatars.discourse-cdn.com/v4/letter/f/9e8a1a/32.png) [@Farouk\_Samu](https://discuss.elastic.co/u/Farouk_Samu)\
**Post date:** [April 5, 2016, 1:48am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/1 "2016-04-05T01:48:22Z")

</div>

Can some one help me resolve this error

root@logstash:/opt/logstash/bin# ./logstash -f logstash.conf  
Apr 04, 2016 7:53:07 PM org.elasticsearch.node.internal.InternalNode   
INFO: [logstash-logstash-3557-12128] version[1.7.0], pid[3557], build[929b973/2015-07-16T14:31:07Z]  
Apr 04, 2016 7:53:07 PM org.elasticsearch.node.internal.InternalNode   
INFO: [logstash-logstash-3557-12128] initializing ...  
Apr 04, 2016 7:53:07 PM org.elasticsearch.plugins.PluginsService   
INFO: [logstash-logstash-3557-12128] loaded [], sites []  
Apr 04, 2016 7:53:10 PM org.elasticsearch.bootstrap.Natives   
WARNING: JNA not found. native methods will be disabled.  
Apr 04, 2016 7:53:11 PM org.elasticsearch.node.internal.InternalNode   
INFO: [logstash-logstash-3557-12128] initialized  
Apr 04, 2016 7:53:11 PM org.elasticsearch.node.internal.InternalNode start  
INFO: [logstash-logstash-3557-12128] starting ...  
Apr 04, 2016 7:53:11 PM org.elasticsearch.transport.TransportService doStart  
INFO: [logstash-logstash-3557-12128] bound\_address {inet[/0:0:0:0:0:0:0:0:9301]}, publish\_address {inet[/192.168.1.14:9301]}  
Apr 04, 2016 7:53:11 PM org.elasticsearch.discovery.DiscoveryService doStart  
INFO: [logstash-logstash-3557-12128] elasticsearch/1GIoi9U\_SUyDJgn8egGUew  
Apr 04, 2016 7:53:15 PM org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing$4 handleException  
WARNING: [logstash-logstash-3557-12128] failed to send ping to [[#zen\_unicast\_1#][logstash][inet[localhost/127.0.0.1:9200]]]  
org.elasticsearch.transport.ReceiveTimeoutTransportException: [][inet[localhost/127.0.0.1:9200]][internal:discovery/zen/unicast\_gte\_1\_4] request\_id [0] timed out after [3752ms]  
at org.elasticsearch.transport.TransportService$TimeoutHandler.run(TransportService.java:529)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
at java.lang.Thread.run(Thread.java:745)

Apr 04, 2016 7:53:19 PM org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing$4 handleException  
WARNING: [logstash-logstash-3557-12128] failed to send ping to [[#zen\_unicast\_1#][logstash][inet[localhost/127.0.0.1:9200]]]  
org.elasticsearch.transport.ReceiveTimeoutTransportException: [][inet[localhost/127.0.0.1:9200]][internal:discovery/zen/unicast\_gte\_1\_4] request\_id [3] timed out after [3751ms]  
at org.elasticsearch.transport.TransportService$TimeoutHandler.run(TransportService.java:529)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
at java.lang.Thread.run(Thread.java:745)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2016, 2:02am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/2 "2016-04-05T02:02:49Z")

</div>

Try using the HTTP protocol in the ES output.

---

<div class="post-metadata">

**Author:** ![Farouk\_Samu](https://avatars.discourse-cdn.com/v4/letter/f/9e8a1a/32.png) [@Farouk\_Samu](https://discuss.elastic.co/u/Farouk_Samu)\
**Post date:** [April 5, 2016, 4:05am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/3 "2016-04-05T04:05:01Z")

</div>

I got this below error after adding protocol =\> http

Trouble parsing json {:source=\>"rest", :raw=\>"CONNECTION\_LOST", :exception=\>#\<LogStash::Json::ParserError: Unrecognized token 'CONNECTION\_LOST': was expecting ('true', 'false' or 'null')  
at [Source: [B@1e93758; line: 1, column: 31]\>, :level=\>:warn}  
Trouble parsing json {:source=\>"rest", :raw=\>"CONNECTION\_LOST", :exception=\>#\<LogStash::Json::ParserError: Unrecognized token 'CONNECTION\_LOST': was expecting ('true', 'false' or 'null')  
at [Source: [B@a54131; line: 1, column: 31]\>, :level=\>:warn}  
^CSIGINT received. Shutting down the pipeline. {:level=\>:warn}  
Logstash shutdown completed

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2016, 5:26am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/4 "2016-04-05T05:26:31Z")

</div>

Can you post your config? OS? LS version? Java version?

---

<div class="post-metadata">

**Author:** ![Farouk\_Samu](https://avatars.discourse-cdn.com/v4/letter/f/9e8a1a/32.png) [@Farouk\_Samu](https://discuss.elastic.co/u/Farouk_Samu)\
**Post date:** [April 5, 2016, 6:28am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/5 "2016-04-05T06:28:38Z")

</div>

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} [%{WORD:text},%{NUMBER:num},%{IPV4:attack\_src}]\s\*[%{GREEDYDATA:username}][%{WORD:password}] -\s\*%{GREEDYDATA:rest}" }  
}

mutate {  
gsub =\> ["rest", "'", '"']  
gsub =\> ["rest", "False", "false"]  
}

json {  
source =\> "rest"  
}

mutate {  
remove\_field =\> ["rest", "message"]  
}  
}

output {  
elasticsearch {  
host =\> ["localhost:9200"]  
protocol =\> http  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2016, 6:48am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/6 "2016-04-05T06:48:45Z")

</div>

Try commenting out the sniffing line.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/logstash-filebeat-error/46315/7 "2017-07-06T05:03:56Z")

</div>

Closed on July 6, 2017, 5:03am UTC