# Logstash is not able to connect to ELasticsearch **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2021, 9:46am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206 "2021-08-23T09:46:25Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 23, 2021, 9:46am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/1 "2021-08-23T09:46:25Z")
```auto I am trying to run logstash but getting below error: ./logstash -f /etc/logstash/conf.d/abc.conf WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /opt/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2021-08-23 02:30:48.978 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2021-08-23 02:30:48.993 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.8.6"} [INFO] 2021-08-23 02:30:57.957 [Converge PipelineAction::Create
] pipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>20, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50} [INFO] 2021-08-23 02:30:58.497 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://elastic:xxxxxx@xxxxxx.xxx.xxx:9200/, https://elastic:xxxxxx@nj2pelkap02.dmz.lava:9200/, https://elastic:xxxxxx@xxxxxx.xxx.xxx:9200/, https://elastic:xxxxxx@nj2pelkap04.dmz.lava:9200/]}} [WARN] 2021-08-23 02:30:58.968 [[main]-pipeline-manager] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@xxxxxx.xxx.xxx:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@xxxxxx.xxx.xxx:9200/][Manticore::ClientProtocolException] Received fatal alert: handshake_failure"} ``` type or paste code here ```auto ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 23, 2021, 9:59am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/2 "2021-08-23T09:59:54Z")
> [@Aboli\_77](#): > > `Elasticsearch Unreachable` Can you `curl nj2pelkap04.dmz.lava:9200` from the Logstash host? ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 23, 2021, 10:06am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/3 "2021-08-23T10:06:28Z")
curl: (52) Empty reply from server ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 23, 2021, 10:07am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/4 "2021-08-23T10:07:28Z")
Can you connect to Elasticsearch at all from elsewhere? ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 23, 2021, 10:09am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/5 "2021-08-23T10:09:18Z")
I am able to launch Kibana URL from one of the servers (Kibana is configured on only one server). ES is on 4 servers: 3 master node 1 data node ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 23, 2021, 4:48pm UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/6 "2021-08-23T16:48:01Z")
```auto I have just now opened elasticsearch.log and found error like below: caught exception while handling client http traffic, closing connection [id: 0xda4a5c2f, L:0.0.0.0/0.0.0.0:92 00 ! R:/10.99.97.91:34642] io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: no cipher suites in common at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.32.Final.jar:4.1.32.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.32.Final.jar:4.1.32.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.32.Final.jar:4.1.32.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434) [netty-transport-4.1.32.Final.jar:4.1.32.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerCont`Preformatted text` ``` ---
**Author:** ![liuliugang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liuliugang/32/89053_2.png) [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Post date:** [August 24, 2021, 10:05am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/7 "2021-08-24T10:05:58Z")
This problem may occur when you use the configuration method of official documents, which I have encountered before ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 24, 2021, 10:58am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/8 "2021-08-24T10:58:29Z")
What did you try to solve the problem? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 24, 2021, 12:16pm UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/9 "2021-08-24T12:16:26Z")
> [@Aboli\_77](#): > > `Received fatal alert: handshake_failure` This is TLS error, it seems to be a certificate issue. What is your `elasticsearch` output in the logstash config you are using? Please share it. ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 26, 2021, 5:10am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/10 "2021-08-26T05:10:57Z")
```auto output { if "_grokparsefailure" not in [tags] and "_dateparsefailure" not in [tags]{ elasticsearch { hosts => ["https://aaaaaaaaa:9200", "https://bbbbbbbbbb:9200", "https://ccccccccc:9200", "https://dddddddddd:9200"] manage_template => false ssl => true ssl_certificate_verification => true #cacert => "/etc/logstash/ssl/cacerts/abcd.pem" cacert => '/etc/logstash/ssl/certs/ca/ca.crt' user => "logstash_writer" password => "${logstash.writer.password}" } } } ``` ---
**Author:** ![liuliugang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liuliugang/32/89053_2.png) [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Post date:** [August 27, 2021, 2:40am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/11 "2021-08-27T02:40:00Z")
You can try extracting the logstash certificate for ES with the following command Then replace ca.cart with logstash.pem openssl pkcs12 -in elastic-stack-ca.p12 -clcerts -nokeys \> logstash.cer openssl x509 -in logstash.cer -out logstash.pem -days 1095 ---
**Author:** ![Aboli\_77](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\ **Post date:** [August 27, 2021, 7:30am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/12 "2021-08-27T07:30:54Z")
```auto openssl pkcs12 -in elastic-stack-ca.p12 -clcerts -nokeys > logstash.cer Error opening input file elastic-stack-ca.p12 elastic-stack-ca.p12: No such file or directory ``` ---
**Author:** ![liuliugang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liuliugang/32/89053_2.png) [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Post date:** [September 2, 2021, 1:07am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/13 "2021-09-02T01:07:40Z")
This is a relative path, or you can use an absolute path ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 30, 2021, 1:08am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206/14 "2021-09-30T01:08:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.