Logstash is running but we are getting error in the logs


(JAYALAKSHMI R) #1

Hi All,

We have configured the logstash as below.

input {
elasticsearch {
hosts => "localhost:9202"
index => "index_name"
size => 100
scroll => "1m"
docinfo => true
}
}

filter {
mutate {
remove_field => [ "@version", "@timestamp" ]
}
}

output {
elasticsearch {
hosts => "localhost:9204"
user => "username"
password => "password"
sniffing => true
index => "%{[@metadata][_index]}"
document_type => "%{[@metadata][_type]}"
document_id => "%{[@metadata][_id]}"
}
}

While executing logstash we could see that the data is moving from the source and destination but getting the below error in the log file.

[2017-08-04T02:54:07,621][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2017-08-04T02:54:12,572][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://username:xxxxxx@localhost:9244/, http://username:xxxxxx@localhost:9284/]}}
[2017-08-04T02:54:12,588][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://username:xxxxxx@localhost:9244/, :path=>"/"}
[2017-08-04T02:54:12,826][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>#Java::JavaNet::URI:0xd24bfbb}
[2017-08-04T02:54:12,826][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://username:xxxxxx@localhost:9284/, :path=>"/"}
[2017-08-04T02:54:13,090][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>#Java::JavaNet::URI:0x50ed996}
[2017-08-04T02:57:13,292][WARN ][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://username:xxxxxx@localhost:9244/][Manticore::SocketTimeout] Read timed out {:url=>http://username:xxxxxx@localhost:9244/, :error_message=>"Elasticsearch Unreachable: [http://username:xxxxxx@localhost:9244/][Manticore::SocketTimeout] Read timed out", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}
[2017-08-04T02:57:13,296][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error_message=>"Elasticsearch Unreachable: [http://username:xxxxxx@localhost:9244/][Manticore::SocketTimeout] Read timed out", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :will_retry_in_seconds=>2}

Can someone help here?


(JAYALAKSHMI R) #2

Hi All,

Can someone help here?


(Tat Dat Pham) #3

Can you use xpack right? Install Xpack in Logstash and ES?
Check firewall between logstash and ES
I saw from log, Logstash is trying connect to ES via port 9244 TCP

[http://username:xxxxxx@localhost:9244/][Manticore::SocketTimeout] Read timed out”


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.