Logstash indexing Error

[shrikantgulia (Shrikant)]

Dear Team,

while indexing the logs from wazuh to logstash and from logstash while indexing to ES getting the error
Attempted to send a bulk request but Elasticsearch appears to be unreachable or down {:message=>"Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset by peer (Write failed)"

I checked my ES cluster is up and running fine and in the output more then one ES nodes have been mentioned.
before some days it was running fine and indexing the logs in ES.

can someone please guide .

Regards

[Tomo_M (Tomohiro Mitani)]

Hi,

I suppose the hosts setting (http://elastic:xxxxxx@ip:9200/) does not match specification.
It may be IP, HOST, IP:port, or HOST:port. Is it the reason??

[shrikantgulia (Shrikant)]

Hi,

Thanks for the response
IP is perfect i have intentionally removed the IP

May 12 15:24:42 nvmbdefgprv016789 logstash[9405]: [2022-05-12T15:24:42,766][WARN ][logstash.outputs.Elasticsearch][checkw2][54bc95471cb1f3081f253d89473aca635f54a] Marking url as dead. Last error: [LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset by peer (Write failed) {:url=>http://elastic:xxxxxx@IP:9200/, :error_message=>"Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset by peer (Write failed)", :error_class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError"}May 12 15:24:42 nvmbdefgprv016789 logstash[9405]: [2022-05-12T15:24:42,767][ERROR][logstash.outputs.Elasticsearch][checkw2][54bc954789bd3ed19ea8a5b295cca635f54a] Attempted to send a bulk request but Elasticsearch appears to be unreachable or down {:message=>"Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset by peer (Write failed)", :exception=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :will_retry_in_seconds=>32}May 12 15:24:43 nvmdfedprv016789 logstash[9405]: [2022-05-12T15:24:43,468][WARN ][logstash.outputs.Elasticsearch][checkw2][54bc954789bf3081f253d89473acca635f54a] Marking url as dead. Last error: [LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset {:url=>http://elastic:xxxxxx@IP:9200/, :error_message=>"Elasticsearch Unreachable: [http://elastic:xxxxxx@IP:9200/][Manticore::SocketException] Connection reset", :error_class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError"}

Regards