# Logstash giving error "Elasticsearch Unreachable

**URL:** <https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515>\
**Category:** Logstash\
**Created:** [September 2, 2022, 7:53am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515 "2022-09-02T07:53:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amit\_sah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_sah/32/110379_2.png) [@Amit\_sah](https://discuss.elastic.co/u/Amit_sah)\
**Post date:** [September 2, 2022, 7:53am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/1 "2022-09-02T07:53:58Z")

</div>

[2022-09-02T13:20:38,199][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}  
[2022-09-02T13:20:43,232][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond\>}  
[2022-09-02T13:20:43,233][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}  
[2022-09-02T13:20:48,245][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond\>}  
[2022-09-02T13:20:48,246][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}  
[2022-09-02T13:20:53,257][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>#\<Java::OrgApacheHttp::NoHttpResponseException: localhost:9200 failed to respond\>}  
[2022-09-02T13:20:53,259][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://elastic:xxxxxx@localhost:9200/](http://elastic:xxxxxx@localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"}

my logstash.conf is like this  
stdin { }  
}

output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "this\_log\_index\_name"

}  
stdout { codec =\> json }  
}

#elasticsearch and kibana is working fine but logstash is not connecting

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0242323170e422408e225aa51d9de05fb21f8b5c.png)

---

<div class="post-metadata">

**Author:** ![cheshirecat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheshirecat/32/109532_2.png) [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Post date:** [September 2, 2022, 7:58am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/2 "2022-09-02T07:58:20Z")

</div>

Hello There!  
Please share your whole `logstash.conf` file (using \</\> tag - it will be easier to read and analyze).  
Could you please also show us your `elasticsearch.yml`, `kibana.yml` and `logstash.yml`?

---

<div class="post-metadata">

**Author:** ![Amit\_sah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_sah/32/110379_2.png) [@Amit\_sah](https://discuss.elastic.co/u/Amit_sah)\
**Post date:** [September 2, 2022, 9:28am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/3 "2022-09-02T09:28:31Z")

</div>

elsaticsearch.yml

# ======================== Elasticsearch Configuration =========================

# 

# NOTE: Elasticsearch comes with reasonable defaults for most settings.

# Before you set out to tweak and tune the configuration, make sure you

# understand what are you trying to accomplish and the consequences.

# 

# The primary way of configuring a node is via this file. This template lists

# the most important settings you may want to configure for a production cluster.

# 

# Please consult the documentation for further information on configuration options:

# [Elasticsearch Guide | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/index.html)

# 

# ---------------------------------- Cluster -----------------------------------

# 

# Use a descriptive name for your cluster:

# 

#cluster.name: my-application

# 

# ------------------------------------ Node ------------------------------------

# 

# Use a descriptive name for the node:

# 

#node.name: node-1

# 

# Add custom attributes to the node:

# 

#node.attr.rack: r1

# 

# ----------------------------------- Paths ------------------------------------

# 

# Path to directory where to store the data (separate multiple locations by comma):

# 

#path.data: /path/to/data

# 

# Path to log files:

# 

#path.logs: /path/to/logs

# 

# ----------------------------------- Memory -----------------------------------

# 

# Lock the memory on startup:

# 

#bootstrap.memory\_lock: true

# 

# Make sure that the heap size is set to about half the memory available

# on the system and that the owner of the process is allowed to use this

# limit.

# 

# Elasticsearch performs poorly when the system is swapping the memory.

# 

# ---------------------------------- Network -----------------------------------

# 

# By default Elasticsearch is only accessible on localhost. Set a different

# address here to expose this node on the network:

# 

#network.host: 192.168.0.1

# 

# By default Elasticsearch listens for HTTP traffic on the first free port it

# finds starting at 9200. Set a specific HTTP port here:

# 

#http.port: 9200

# 

# For more information, consult the network module documentation.

# 

# --------------------------------- Discovery ----------------------------------

# 

# Pass an initial list of hosts to perform discovery when this node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

# 

#discovery.seed\_hosts: ["host1", "host2"]

# 

# Bootstrap the cluster using an initial set of master-eligible nodes:

# 

#cluster.initial\_master\_nodes: ["node-1", "node-2"]

# 

# For more information, consult the discovery and cluster formation module documentation.

# 

# --------------------------------- Readiness ----------------------------------

# 

# Enable an unauthenticated TCP readiness endpoint on localhost

# 

#readiness.port: 9399

# 

# ---------------------------------- Various -----------------------------------

# 

# Allow wildcard deletion of indices:

# 

#action.destructive\_requires\_name: false

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------

# 

# The following settings, TLS certificates, and keys have been automatically

# generated to configure Elasticsearch security features on 31-08-2022 18:36:51

# 

# --------------------------------------------------------------------------------

# Enable security features

xpack.security.enabled: true

xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents

xpack.security.http.ssl:

enabled: true

keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes

xpack.security.transport.ssl:

enabled: true

verification\_mode: certificate

keystore.path: certs/transport.p12

truststore.path: certs/transport.p12

# Create a new cluster with the current node only

# Additional nodes can still join the cluster later

cluster.initial\_master\_nodes: ["LAPTOP-7MJ794OO"]

# Allow HTTP API connections from anywhere

# Connections are encrypted and require user authentication

http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere

# Connections are encrypted and mutually authenticated

#transport.host: 0.0.0.0

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

kibana.yml

# For more configuration options see the configuration guide for Kibana in

# [Elastic Docs | Elastic](https://www.elastic.co/guide/index.html)

# =================== System: Kibana Server ===================

# Kibana is served by a back end server. This setting specifies the port to use.

#server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

# The default is 'localhost', which usually means remote machines will not be able to connect.

# To allow connections from remote users, set this parameter to a non-loopback address.

#server.host: "localhost"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.

# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath

# from requests it receives, and to prevent a deprecation warning at startup.

# This setting cannot end in a slash.

#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with

# `server.basePath` or require that they are rewritten by your reverse proxy.

# Defaults to `false`.

#server.rewriteBasePath: false

# Specifies the public URL at which Kibana is available for end users. If

# `server.basePath` is configured this URL should end with the same basePath.

#server.publicBaseUrl: ""

# The maximum payload size in bytes for incoming server requests.

#server.maxPayload: 1048576

# The Kibana server's name. This is used for display purposes.

#server.name: "your-hostname"

# =================== System: Kibana Server (Optional) ===================

# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.

# These settings enable SSL for outgoing requests from the Kibana server to the browser.

#server.ssl.enabled: false

#server.ssl.certificate: /path/to/your/server.crt

#server.ssl.key: /path/to/your/server.key

# =================== System: Elasticsearch ===================

# The URLs of the Elasticsearch instances to use for all your queries.

#elasticsearch.hosts: ["[http://localhost:9200](http://localhost:9200)"]

# If your Elasticsearch is protected with basic authentication, these settings provide

# the username and password that the Kibana server uses to perform maintenance on the Kibana

# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which

# is proxied through the Kibana server.

#elasticsearch.username: "kibana\_system"

#elasticsearch.password: "pass"

# Kibana can also authenticate to Elasticsearch via "service account tokens".

# Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.

# Use this token instead of a username/password.

# elasticsearch.serviceAccountToken: "my\_token"

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of

# the elasticsearch.requestTimeout setting.

#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value

# must be a positive integer.

#elasticsearch.requestTimeout: 30000

# The maximum number of sockets that can be used for communications with elasticsearch.

# Defaults to `Infinity`.

#elasticsearch.maxSockets: 1024

# Specifies whether Kibana should use compression for communications with elasticsearch

# Defaults to `false`.

#elasticsearch.compression: false

# List of Kibana client-side headers to send to Elasticsearch. To send _no_ client-side

# headers, set this value to (an empty list).

#elasticsearch.requestHeadersWhitelist: [authorization]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten

# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.

#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.

#elasticsearch.shardTimeout: 30000

# =================== System: Elasticsearch (Optional) ===================

# These files are used to verify the identity of Kibana to Elasticsearch and are required when

# xpack.security.http.ssl.client\_authentication in Elasticsearch is set to required.

#elasticsearch.ssl.certificate: /path/to/your/client.crt

#elasticsearch.ssl.key: /path/to/your/client.key

# Enables you to specify a path to the PEM file for the certificate

# authority for your Elasticsearch instance.

#elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.

#elasticsearch.ssl.verificationMode: full

# =================== System: Logging ===================

# Set the value of this setting to off to suppress all logging output, or to debug to log everything. Defaults to 'info'

#logging.root.level: debug

# Enables you to specify a file where Kibana stores log output.

#logging.appenders.default:

# type: file

# fileName: /var/logs/kibana.log

# layout:

# type: json

# Logs queries sent to Elasticsearch.

#logging.loggers:

# - name: elasticsearch.query

# level: debug

# Logs http responses.

#logging.loggers:

# - name: http.server.response

# level: debug

# Logs system usage information.

#logging.loggers:

# - name: metrics.ops

# level: debug

# =================== System: Other ===================

# The path where Kibana stores persistent data not saved in Elasticsearch. Defaults to data

#path.data: data

# Specifies the path where Kibana creates the process ID file.

#pid.file: /run/kibana/kibana.pid

# Set the interval in milliseconds to sample system and process performance

# metrics. Minimum is 100ms. Defaults to 5000ms.

#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.

# Supported languages are the following: English (default) "en", Chinese "zh-CN", Japanese "ja-JP", French "fr-FR".

#i18n.locale: "en"

# =================== Frequently used (Optional)===================

# =================== Saved Objects: Migrations ===================

# Saved object migrations run at startup. If you run into migration-related issues, you might need to adjust these settings.

# The number of documents migrated at a time.

# If Kibana can't start up or upgrade due to an Elasticsearch `circuit_breaking_exception`,

# use a smaller batchSize value to reduce the memory pressure. Defaults to 1000 objects per batch.

#migrations.batchSize: 1000

# The maximum payload size for indexing batches of upgraded saved objects.

# To avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch.

# This value should be lower than or equal to your Elasticsearch cluster’s `http.max_content_length`

# configuration option. Default: 100mb

#migrations.maxBatchSizeBytes: 100mb

# The number of times to retry temporary migration failures. Increase the setting

# if migrations fail frequently with a message such as `Unable to complete the [...] step after

# 15 attempts, terminating`. Defaults to 15

#migrations.retryAttempts: 15

# =================== Search Autocomplete ===================

# Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.

# This value must be a whole number greater than zero. Defaults to 1000ms

#unifiedSearch.autocomplete.valueSuggestions.timeout: 1000

# Maximum number of documents loaded by each shard to generate autocomplete suggestions.

# This value must be a whole number greater than zero. Defaults to 100\_000

#unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 100000

# This section was automatically generated during setup.

elasticsearch.hosts: ['[https://192.168.0.106:9200](https://192.168.0.106:9200)']

elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NjE5NzEyNzc3ODA6MnRXQWp2ZjBTUmFpUUhpNGdlRENtQQ

elasticsearch.ssl.certificateAuthorities: ['C:\ELK STACK\kibana-8.4.0\data\ca\_1661971278427.crt']

xpack.fleet.outputs: [{id: fleet-default-output, name: default, is\_default: true, is\_default\_monitoring: true, type: elasticsearch, hosts: ['[https://192.168.0.106:9200](https://192.168.0.106:9200)'], ca\_trusted\_fingerprint: a0a8042323147f6a7978507958f74e546d1871ad7f2fc02eda23fd2c2b02eda6}]

logstash.yml

# Settings file in YAML

# 

# Settings can be specified either in hierarchical form, e.g.:

# 

# pipeline:

# batch:

# size: 125

# delay: 5

# 

# Or as flat keys:

# 

# pipeline.batch.size: 125

# pipeline.batch.delay: 5

# 

# ------------ Node identity ------------

# 

# Use a descriptive name for the node:

# 

# node.name: test

# 

# If omitted the node name will default to the machine's host name

# 

# ------------ Data path ------------------

# 

# Which directory should be used by logstash and its plugins

# for any persistent needs. Defaults to LOGSTASH\_HOME/data

# 

# path.data:

# 

# ------------ Pipeline Settings --------------

# 

# The ID of the pipeline.

# 

# pipeline.id: main

# 

# Set the number of workers that will, in parallel, execute the filters+outputs

# stage of the pipeline.

# 

# This defaults to the number of the host's CPU cores.

# 

# pipeline.workers: 2

# 

# How many events to retrieve from inputs before sending to filters+workers

# 

# pipeline.batch.size: 125

# 

# How long to wait in milliseconds while polling for the next event

# before dispatching an undersized batch to filters+outputs

# 

# pipeline.batch.delay: 50

# 

# Force Logstash to exit during shutdown even if there are still inflight

# events in memory. By default, logstash will refuse to quit until all

# received events have been pushed to the outputs.

# 

# WARNING: Enabling this can lead to data loss during shutdown

# 

# pipeline.unsafe\_shutdown: false

# 

# Set the pipeline event ordering. Options are "auto" (the default), "true" or "false".

# "auto" automatically enables ordering if the 'pipeline.workers' setting

# is also set to '1', and disables otherwise.

# "true" enforces ordering on the pipeline and prevent logstash from starting

# if there are multiple workers.

# "false" disables any extra processing necessary for preserving ordering.

# 

# pipeline.ordered: auto

# 

# Sets the pipeline's default value for `ecs_compatibility`, a setting that is

# available to plugins that implement an ECS Compatibility mode for use with

# the Elastic Common Schema.

# Possible values are:

# - disabled

# - v1

# - v8 (default)

# Pipelines defined before Logstash 8 operated without ECS in mind. To ensure a

# migrated pipeline continues to operate as it did before your upgrade, opt-OUT

# of ECS for the individual pipeline in its `pipelines.yml` definition. Setting

# it here will set the default for _all_ pipelines, including new ones.

# 

# pipeline.ecs\_compatibility: v8

# 

# ------------ Pipeline Configuration Settings --------------

# 

# Where to fetch the pipeline configuration for the main pipeline

# 

# path.config:

# 

# Pipeline configuration string for the main pipeline

# 

# config.string:

# 

# At startup, test if the configuration is valid and exit (dry run)

# 

# config.test\_and\_exit: false

# 

# Periodically check if the configuration has changed and reload the pipeline

# This can also be triggered manually through the SIGHUP signal

# 

# config.reload.automatic: false

# 

# How often to check if the pipeline configuration has changed (in seconds)

# Note that the unit value (s) is required. Values without a qualifier (e.g. 60)

# are treated as nanoseconds.

# Setting the interval this way is not recommended and might change in later versions.

# 

# config.reload.interval: 3s

# 

# Show fully compiled configuration as debug log message

# NOTE: --log.level must be 'debug'

# 

# config.debug: false

# 

# When enabled, process escaped characters such as \n and " in strings in the

# pipeline configuration files.

# 

# config.support\_escapes: false

# 

# ------------ API Settings -------------

# Define settings related to the HTTP API here.

# 

# The HTTP API is enabled by default. It can be disabled, but features that rely

# on it will not work as intended.

# 

# api.enabled: true

# 

# By default, the HTTP API is not secured and is therefore bound to only the

# host's loopback interface, ensuring that it is not accessible to the rest of

# the network.

# When secured with SSL and Basic Auth, the API is bound to _all_ interfaces

# unless configured otherwise.

# 

# api.http.host: 127.0.0.1

# 

# The HTTP API web server will listen on an available port from the given range.

# Values can be specified as a single port (e.g., `9600`), or an inclusive range

# of ports (e.g., `9600-9700`).

# 

# api.http.port: 9600-9700

# 

# The HTTP API includes a customizable "environment" value in its response,

# which can be configured here.

# 

# api.environment: "production"

# 

# The HTTP API can be secured with SSL (TLS). To do so, you will need to provide

# the path to a password-protected keystore in p12 or jks format, along with credentials.

# 

# api.ssl.enabled: false

# api.ssl.keystore.path: /path/to/keystore.jks

# api.ssl.keystore.password: "y0uRp4$$w0rD"

# 

# The HTTP API can be configured to require authentication. Acceptable values are

# - `none`: no auth is required (default)

# - `basic`: clients must authenticate with HTTP Basic auth, as configured

# with `api.auth.basic.*` options below

# api.auth.type: none

# 

# When configured with `api.auth.type` `basic`, you must provide the credentials

# that requests will be validated against. Usage of Environment or Keystore

# variable replacements is encouraged (such as the value `"${HTTP_PASS}"`, which

# resolves to the value stored in the keystore's `HTTP_PASS` variable if present

# or the same variable from the environment)

# 

# api.auth.basic.username: "logstash-user"

# api.auth.basic.password: "s3cUreP4$$w0rD"

# 

# When setting `api.auth.basic.password`, the password should meet

# the default password policy requirements.

# The default password policy requires non-empty minimum 8 char string that

# includes a digit, upper case letter and lower case letter.

# Policy mode sets Logstash to WARN or ERROR when HTTP authentication password doesn't

# meet the password policy requirements.

# The default is WARN. Setting to ERROR enforces stronger passwords (recommended).

# 

# api.auth.basic.password\_policy.mode: WARN

# 

# ------------ Module Settings ---------------

# Define modules here. Modules definitions must be defined as an array.

# The simple way to see this is to prepend each `name` with a `-`, and keep

# all associated variables under the `name` they are associated with, and

# above the next, like this:

# 

# modules:

# - name: MODULE\_NAME

# var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE

# var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE

# var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE

# var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE

# 

# Module variable names must be in the format of

# 

# var.PLUGIN\_TYPE.PLUGIN\_NAME.KEY

# 

# modules:

# 

# ------------ Cloud Settings ---------------

# Define Elastic Cloud settings here.

# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy

# and it may have an label prefix e.g. staging:dXMtZ...

# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'

# cloud.id:

# 

# Format of cloud.auth is: :

# This is optional

# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'

# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'

# cloud.auth: elastic:

# 

# ------------ Queuing Settings --------------

# 

# Internal queuing model, "memory" for legacy in-memory based queuing and

# "persisted" for disk-based acked queueing. Defaults is memory

# 

# queue.type: memory

# 

# If `queue.type: persisted`, the directory path where the pipeline data files will be stored.

# Each pipeline will group its PQ files in a subdirectory matching its `pipeline.id`.

# Default is path.data/queue.

# 

# path.queue:

# 

# If using queue.type: persisted, the page data files size. The queue data consists of

# append-only data files separated into pages. Default is 64mb

# 

# queue.page\_capacity: 64mb

# 

# If using queue.type: persisted, the maximum number of unread events in the queue.

# Default is 0 (unlimited)

# 

# queue.max\_events: 0

# 

# If using queue.type: persisted, the total capacity of the queue in number of bytes.

# If you would like more unacked events to be buffered in Logstash, you can increase the

# capacity using this setting. Please make sure your disk drive has capacity greater than

# the size specified here. If both max\_bytes and max\_events are specified, Logstash will pick

# whichever criteria is reached first

# Default is 1024mb or 1gb

# 

# queue.max\_bytes: 1024mb

# 

# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint

# Default is 1024, 0 for unlimited

# 

# queue.checkpoint.acks: 1024

# 

# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint

# Default is 1024, 0 for unlimited

# 

# queue.checkpoint.writes: 1024

# 

# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page

# Default is 1000, 0 for no periodic checkpoint.

# 

# queue.checkpoint.interval: 1000

# 

# ------------ Dead-Letter Queue Settings --------------

# Flag to turn on dead-letter queue.

# 

# dead\_letter\_queue.enable: false

# If using dead\_letter\_queue.enable: true, the maximum size of each dead letter queue. Entries

# will be dropped if they would increase the size of the dead letter queue beyond this setting.

# Default is 1024mb

# dead\_letter\_queue.max\_bytes: 1024mb

# If using dead\_letter\_queue.enable: true, the interval in milliseconds where if no further events eligible for the DLQ

# have been created, a dead letter queue file will be written. A low value here will mean that more, smaller, queue files

# may be written, while a larger value will introduce more latency between items being "written" to the dead letter queue, and

# being available to be read by the dead\_letter\_queue input when items are written infrequently.

# Default is 5000.

# 

# dead\_letter\_queue.flush\_interval: 5000

# If using dead\_letter\_queue.enable: true, controls which entries should be dropped to avoid exceeding the size limit.

# Set the value to `drop_newer` (default) to stop accepting new events that would push the DLQ size over the limit.

# Set the value to `drop_older` to remove queue pages containing the oldest events to make space for new ones.

# 

# dead\_letter\_queue.storage\_policy: drop\_newer

# If using dead\_letter\_queue.enable: true, the interval that events have to be considered valid. After the interval has

# expired the events could be automatically deleted from the DLQ.

# The interval could be expressed in days, hours, minutes or seconds, using as postfix notation like 5d,

# to represent a five days interval.

# The available units are respectively d, h, m, s for day, hours, minutes and seconds.

# If not specified then the DLQ doesn't use any age policy for cleaning events.

# 

# dead\_letter\_queue.retain.age: 1d

# If using dead\_letter\_queue.enable: true, defines the action to take when the dead\_letter\_queue.max\_bytes is reached,

# could be "drop\_newer" or "drop\_older".

# With drop\_newer, messages that were inserted most recently are dropped, logging an error line.

# With drop\_older setting, the oldest messages are dropped as new ones are inserted.

# Default value is "drop\_newer".

# dead\_letter\_queue.storage\_policy: drop\_newer

# If using dead\_letter\_queue.enable: true, the directory path where the data files will be stored.

# Default is path.data/dead\_letter\_queue

# 

# path.dead\_letter\_queue:

# 

# ------------ Debugging Settings --------------

# 

# Options for log.level:

# \* fatal

# \* error

# \* warn

# \* info (default)

# \* debug

# \* trace

# 

# log.level: info

# path.logs:

# 

# ------------ Other Settings --------------

# 

# Allow or block running Logstash as superuser (default: true)

# allow\_superuser: false

# 

# Where to find custom plugins

# path.plugins:

# 

# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name

# Default is false

# pipeline.separate\_logs: false

# 

# ------------ X-Pack Settings (not applicable for OSS build)--------------

# 

# X-Pack Monitoring

# [Monitoring Logstash with APIs | Logstash](https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html)

#xpack.monitoring.enabled: false

#xpack.monitoring.elasticsearch.username: logstash\_system

#xpack.monitoring.elasticsearch.password: password

#xpack.monitoring.elasticsearch.proxy: ["[http://proxy](http://proxy):port"]

#xpack.monitoring.elasticsearch.hosts: ["[https://es1:9200](https://es1:9200)", "[https://es2:9200](https://es2:9200)"]

# an alternative to hosts + username/password settings is to use cloud\_id/cloud\_auth

#xpack.monitoring.elasticsearch.cloud\_id: monitoring\_cluster\_id:xxxxxxxxxx

#xpack.monitoring.elasticsearch.cloud\_auth: logstash\_system:password

# another authentication alternative is to use an Elasticsearch API key

#xpack.monitoring.elasticsearch.api\_key: "id:api\_key"

#xpack.monitoring.elasticsearch.ssl.certificate\_authority: "/path/to/ca.crt"

#xpack.monitoring.elasticsearch.ssl.ca\_trusted\_fingerprint: xxxxxxxxxx

#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file

#xpack.monitoring.elasticsearch.ssl.truststore.password: password

#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file

#xpack.monitoring.elasticsearch.ssl.keystore.password: password

#xpack.monitoring.elasticsearch.ssl.verification\_mode: certificate

#xpack.monitoring.elasticsearch.sniffing: false

#xpack.monitoring.collection.interval: 10s

#xpack.monitoring.collection.pipeline.details.enabled: true

# 

# X-Pack Management

# [Centralized Pipeline Management | Logstash](https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html)

#xpack.management.enabled: false

#xpack.management.pipeline.id: ["main", "apache\_logs"]

#xpack.management.elasticsearch.username: logstash\_admin\_user

#xpack.management.elasticsearch.password: password

#xpack.management.elasticsearch.proxy: ["[http://proxy](http://proxy):port"]

#xpack.management.elasticsearch.hosts: ["[https://es1:9200](https://es1:9200)", "[https://es2:9200](https://es2:9200)"]

# an alternative to hosts + username/password settings is to use cloud\_id/cloud\_auth

#xpack.management.elasticsearch.cloud\_id: management\_cluster\_id:xxxxxxxxxx

#xpack.management.elasticsearch.cloud\_auth: logstash\_admin\_user:password

# another authentication alternative is to use an Elasticsearch API key

#xpack.management.elasticsearch.api\_key: "id:api\_key"

#xpack.management.elasticsearch.ssl.ca\_trusted\_fingerprint: xxxxxxxxxx

#xpack.management.elasticsearch.ssl.certificate\_authority: "/path/to/ca.crt"

#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file

#xpack.management.elasticsearch.ssl.truststore.password: password

#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file

#xpack.management.elasticsearch.ssl.keystore.password: password

#xpack.management.elasticsearch.ssl.verification\_mode: certificate

#xpack.management.elasticsearch.sniffing: false

#xpack.management.logstash.poll\_interval: 5s

# X-Pack GeoIP plugin

# [Geoip filter plugin | Logstash Plugins](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-manage_update)

#xpack.geoip.download.endpoint: "[https://geoip.elastic.co/v1/database](https://geoip.elastic.co/v1/database)"

---

<div class="post-metadata">

**Author:** ![Amit\_sah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_sah/32/110379_2.png) [@Amit\_sah](https://discuss.elastic.co/u/Amit_sah)\
**Post date:** [September 2, 2022, 9:29am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/4 "2022-09-02T09:29:35Z")

</div>

@cheshirecat Please help. I have attached all files

logstash.conf

stdin { }  
}

output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200/)"]  
index =\> "this\_log\_index\_name"

}  
stdout { codec =\> json }  
}

---

<div class="post-metadata">

**Author:** ![cheshirecat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheshirecat/32/109532_2.png) [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Post date:** [September 2, 2022, 9:34am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/5 "2022-09-02T09:34:33Z")

</div>

What the... please edit your post and use code tag \</\> for configuration files. Your post is unreadable now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2022, 9:34am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515/6 "2022-09-30T09:34:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.