Logstash join to ES error


logstash cant join to elasticsearch. How i can fix it? :frowning:

[2018-02-11T23:59:17,488][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>, :path=>"/"}

[2018-02-11T23:59:17,491][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::P$


input {
 file {
  path => "/var/log/test.log"
  start_position => "beginning"
  udp {
    host => ""
    port => "10514"
    codec => "json"
    type => "rsyslog"
filter {}
output {
index => "new"
  if [type] == "rsyslog" {
    elasticsearch {
      hosts => [""]


(Alex Stiff) #2

Have you recently installed X-Pack? I had this problem until I added the below lines to logstash.yml:

xpack.monitoring.enabled: true


Hi, x-pack isnt installed on server.

(Jonas D) #4

Is Logstash running on the same machine as Elasticsearch? I'd suggest you check if Elasticsearch is listening, for example by using curl -XGET "". This should return basic information about your Elasticsearch node running on that address and the cluster it belongs to.


Yes, logstash i running on same machine as ES.
Command curl work:

  "name" : "syslogSTORE",
  "cluster_name" : "syslog",
  "cluster_uuid" : "x63VkzfJTtSndsx4v7ucEg",
  "version" : {
    "number" : "5.6.7",
    "build_hash" : "4669214",
    "build_date" : "2018-01-25T21:14:50.776Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.1"
  "tagline" : "You Know, for Search"

(Jonas D) #6

Can you telnet to this machine on port 9200 from another machine in the same network?


Yes, telnet is working from another machine.

(Jonas D) #8

Can you remove this from the pipeline config or put it inside the elasticsearch {} output?

(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.