# Logstash is not connecting with ElasticSearch and I don't find any error

**URL:** <https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818>\
**Category:** Logstash\
**Created:** [April 27, 2017, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818 "2017-04-27T08:23:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alvaro\_Sanz\_Garrigue](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Alvaro\_Sanz\_Garrigue](https://discuss.elastic.co/u/Alvaro_Sanz_Garrigue)\
**Post date:** [April 27, 2017, 8:23am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/1 "2017-04-27T08:23:26Z")

</div>

Hell I'm new with elasticSearch and logstahs and I'm having some problems.

I'm Trying to connect Logstash and ES with a simple conf file but nothing happens in ES and I can get the error from the logs.

> ```
> input {
> 
> ```

```
 	file{
 		path => ["/Users/asanzgarrigues/Desktop/logstash-plain.log"]
 		start_position => "beginning"
 		type => "logs"
 	}
 }
 # The filter part of this file is commented out to indicate that it is
 # optional.
 # filter {
 #
 # }
 output {
 elasticsearch { 
 	 hosts => ["http://localhost:9203"]
 	 action => "index"
 	 index => "prueba"
 	 } 
     stdout { codec => rubydebug }
 }

```

The ES port is 9203 and I change it in the Elasticsearch.yml configuration file.

When I executed logstahs with:

```
C:\Users\asanzgarrigues\Desktop\elastic\logstash-5.3.0\bin>logstash -f prueba.conf

```

I get the following response:

> Sending Logstash's logs to C:/Users/asanzgarrigues/Desktop/elastic/logstash-5.3.0/logs which is now configured via log4j2.properties  
> [2017-04-27T10:13:59,271][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://localhost:9203/](http://localhost:9203/)]}}  
> [2017-04-27T10:13:59,271][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9203/](http://localhost:9203/), :path=\>"/"}  
> [2017-04-27T10:13:59,458][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x78fe632b URL:[http://localhost:9203/](http://localhost:9203/)\>}  
> [2017-04-27T10:13:59,458][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
> [2017-04-27T10:13:59,521][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
> [2017-04-27T10:13:59,536][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::HTTP:0x5fd8227c URL:[http://localhost:9203](http://localhost:9203)\>]}  
> [2017-04-27T10:13:59,536][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
> [2017-04-27T10:14:00,593][INFO][logstash.pipeline] Pipeline main started  
> [2017-04-27T10:14:00,749][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

The execution with --debug is too big but it finalizes in a loop like this:

> [2017-04-27T10:18:56,055][DEBUG][logstash.inputs.file] \_globbed\_files: /Users/asanzgarrigues/Desktop/logstash-plain.log: glob is: ["/Users/asanzgarrigues/Desktop/logstash-plain.log"]  
> [2017-04-27T10:19:00,764][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:05,766][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:10,774][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:11,125][DEBUG][logstash.inputs.file] \_globbed\_files: /Users/asanzgarrigues/Desktop/logstash-plain.log: glob is: ["/Users/asanzgarrigues/Desktop/logstash-plain.log"]  
> [2017-04-27T10:19:15,781][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:20,788][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:25,793][DEBUG][logstash.pipeline] Pushing flush onto pipeline  
> [2017-04-27T10:19:26,196][DEBUG][logstash.inputs.file] \_globbed\_files: /Users/asanzgarrigues/Desktop/logstash-plain.log: glob is: ["/Users/asanzgarrigues/Desktop/logstash-plain.log"]

If the complete debug log is necessary i can post it in various posts

I need your help, I'm blocked with it.

Thank you!

---

<div class="post-metadata">

**Author:** ![Ruthu\_Ramya](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@Ruthu\_Ramya](https://discuss.elastic.co/u/Ruthu_Ramya)\
**Post date:** [April 27, 2017, 9:02am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/2 "2017-04-27T09:02:04Z")

</div>

@Alvaro_Sanz_Garrigue,  
Try these options

1. check if ES is working at 9203, check [http://localhost:9203](http://localhost:9203) in browser and verify
2. can you try to touch the log file.  
`Ex: delete the last line in the log file while Logstash is active`
3. add a sample filter and check
4. output to a file so you are sure that some data is parsed and ready to be shipped out of logstash

Regards,  
Ruthu

---

<div class="post-metadata">

**Author:** ![zegdene](https://avatars.discourse-cdn.com/v4/letter/z/76d3ee/32.png) [@zegdene](https://discuss.elastic.co/u/zegdene)\
**Post date:** [April 27, 2017, 2:16pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/3 "2017-04-27T14:16:08Z")

</div>

Hi ruthu ,  
can you me explain the path to the log file ?? i have the same error  
Thank you

---

<div class="post-metadata">

**Author:** ![Alvaro\_Sanz\_Garrigue](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Alvaro\_Sanz\_Garrigue](https://discuss.elastic.co/u/Alvaro_Sanz_Garrigue)\
**Post date:** [April 27, 2017, 3:22pm UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/4 "2017-04-27T15:22:11Z")

</div>

Thanks for your tips, but it still not working.

**1.check if ES is working at 9203, check http://localhost:92032 in browser and verify**  
I have checked it and it seems that it is working correctly.  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e2a47c01535785b55051285e69925d8f57abefd.png)

**2. can you try to touch the log file.**  
I did it  
**3. add a sample filter and check**  
**4. output to a file so you are sure that some data is parsed and ready to be shipped out of logstash**  
The new .conf file is the following:

```
> input {
> file{
> path => ["/Users/asanzgarrigues/Desktop/logstash-plain.log"]
> start_position => "beginning"
> type => "logs"
> }
> }

> filter {
> grok {
> match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{LOGLEVEL:log_level} \]\[%{DATA:info}\]%{GREEDYDATA:message}" }
> }
> }
> output {

> file{
> path => ["/Users/asanzgarrigues/Desktop/prueba.json"]
> }
> stdout { codec => rubydebug }
> }

```

The log format is the following:

`[2017-04-26T15:05:18,794][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9203/]}}`

When I execute again logstash now appears the following but nothing is written in the destination file.

```
C:\Users\asanzgarrigues\Desktop\elastic\logstash-5.3.0\bin>logstash -f prueba.conf
Sending Logstash's logs to C:/Users/asanzgarrigues/Desktop/elastic/logstash-5.3.0/logs which is now configured via log4j2.properties
[2017-04-27T17:58:21,118][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
[2017-04-27T17:58:21,899][INFO][logstash.pipeline] Pipeline main started
[2017-04-27T17:58:22,087][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} 

```

Now I'm totally lost hahaha. I supose that I'm missing something during the configuration or installation. But I just download ES and logstash zips from [elastic.co](http://elastic.co) and cjange the elastic port configuration and execute the commands `bin\elasticsearch.bat` and `bin/logstash -f logstash.conf` indicated in [https://www.elastic.co/downloads/elasticsearch](https://www.elastic.co/downloads/elasticsearch)  
and  
[https://www.elastic.co/downloads/logstash](https://www.elastic.co/downloads/logstash)

Sorry if my english is too bad. And Thank you for help @Ruthu_Ramya

---

<div class="post-metadata">

**Author:** ![Alvaro\_Sanz\_Garrigue](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Alvaro\_Sanz\_Garrigue](https://discuss.elastic.co/u/Alvaro_Sanz_Garrigue)\
**Post date:** [April 28, 2017, 8:18am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/5 "2017-04-28T08:18:02Z")

</div>

I finally make it works. I was doing it in the enterprise laptop which is restricted. I create a Ubuntu VM where I have the whole control, and there with the same configuration it finally works.  
So I guess that in my enterprise computer there were permissions issues or something like that which denies logstash to work as expected.

You can close this topic.  
Thank you

---

<div class="post-metadata">

**Author:** ![Ruthu\_Ramya](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@Ruthu\_Ramya](https://discuss.elastic.co/u/Ruthu_Ramya)\
**Post date:** [April 28, 2017, 9:01am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/6 "2017-04-28T09:01:46Z")

</div>

@zegdene, try as in the sample posted here. Thats the right one.  
You can use stdout if you want to see the results on the console, refer: [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2017, 9:11am UTC](https://discuss.elastic.co/t/logstash-is-not-connecting-with-elasticsearch-and-i-dont-find-any-error/83818/7 "2017-05-26T09:11:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.