# Logstash is running but we are getting error in the logs

**URL:** <https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827>\
**Category:** Logstash\
**Created:** [August 4, 2017, 7:15am UTC](https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827 "2017-08-04T07:15:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JAYALAKSHMI](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@JAYALAKSHMI](https://discuss.elastic.co/u/JAYALAKSHMI)\
**Post date:** [August 4, 2017, 7:15am UTC](https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827/1 "2017-08-04T07:15:36Z")

</div>

Hi All,

We have configured the logstash as below.

input {  
elasticsearch {  
hosts =\> "localhost:9202"  
index =\> "index\_name"  
size =\> 100  
scroll =\> "1m"  
docinfo =\> true  
}  
}

filter {  
mutate {  
remove\_field =\> ["@version", "@timestamp"]  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9204"  
user =\> "username"  
password =\> "password"  
sniffing =\> true  
index =\> "%{[@metadata][\_index]}"  
document\_type =\> "%{[@metadata][\_type]}"  
document\_id =\> "%{[@metadata][\_id]}"  
}  
}

While executing logstash we could see that the data is moving from the source and destination but getting the below error in the log file.

[2017-08-04T02:54:07,621][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2017-08-04T02:54:12,572][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), [http://username:xxxxxx@localhost:9284/](http://username:xxxxxx@localhost:9284/)]}}  
[2017-08-04T02:54:12,588][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), :path=\>"/"}  
[2017-08-04T02:54:12,826][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#Java::JavaNet::URI:0xd24bfbb}  
[2017-08-04T02:54:12,826][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://username:xxxxxx@localhost:9284/](http://username:xxxxxx@localhost:9284/), :path=\>"/"}  
[2017-08-04T02:54:13,090][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#Java::JavaNet::URI:0x50ed996}  
[2017-08-04T02:57:13,292][WARN][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out {:url=\>[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/), :error\_message=\>"Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out", :error\_class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"}  
[2017-08-04T02:57:13,296][ERROR][logstash.outputs.elasticsearch] Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down! {:error\_message=\>"Elasticsearch Unreachable: [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out", :class=\>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError", :will\_retry\_in\_seconds=\>2}

Can someone help here?

---

<div class="post-metadata">

**Author:** ![JAYALAKSHMI](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@JAYALAKSHMI](https://discuss.elastic.co/u/JAYALAKSHMI)\
**Post date:** [August 7, 2017, 6:48am UTC](https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827/2 "2017-08-07T06:48:55Z")

</div>

Hi All,

Can someone help here?

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [August 8, 2017, 9:38am UTC](https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827/3 "2017-08-08T09:38:53Z")

</div>

Can you use xpack right? Install Xpack in Logstash and ES?  
Check firewall between logstash and ES  
I saw from log, Logstash is trying connect to ES via port 9244 TCP

> [[http://username:xxxxxx@localhost:9244/](http://username:xxxxxx@localhost:9244/)][Manticore::SocketTimeout] Read timed out”

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2017, 9:38am UTC](https://discuss.elastic.co/t/logstash-is-running-but-we-are-getting-error-in-the-logs/95827/4 "2017-09-05T09:38:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.