# Logstash join to ES error

**URL:** <https://discuss.elastic.co/t/logstash-join-to-es-error/119492>\
**Category:** Logstash\
**Created:** [February 12, 2018, 3:05pm UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492 "2018-02-12T15:05:44Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\
**Post date:** [February 12, 2018, 3:05pm UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/1 "2018-02-12T15:05:44Z")

</div>

HI,  
logstash cant join to elasticsearch. How i can fix it? ☹

```
[2018-02-11T23:59:17,488][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://192.168.201.30:9200/, :path=>"/"}

[2018-02-11T23:59:17,491][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://192.168.201.30:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::P$

```

etc/logstash/conf.d:

```
input {
 file {
  path => "/var/log/test.log"
  start_position => "beginning"
}
  udp {
    host => "192.168.201.30"
    port => "10514"
    codec => "json"
    type => "rsyslog"
  }
}
filter {}
output {
index => "new"
  if [type] == "rsyslog" {
    elasticsearch {
      hosts => ["192.168.201.30:9200"]
    }
  }
}

```

Thanks

---

<div class="post-metadata">

**Author:** ![\_Alex](https://avatars.discourse-cdn.com/v4/letter/_/54ee81/32.png) [@\_Alex](https://discuss.elastic.co/u/_Alex)\
**Post date:** [February 12, 2018, 3:27pm UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/2 "2018-02-12T15:27:01Z")

</div>

Have you recently installed X-Pack? I had this problem until I added the below lines to logstash.yml:

```
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.url: http://192.168.201.30:9200
```

---

<div class="post-metadata">

**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\
**Post date:** [February 12, 2018, 3:34pm UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/3 "2018-02-12T15:34:56Z")

</div>

Hi, x-pack isnt installed on server.

---

<div class="post-metadata">

**Author:** ![Jon\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jon_d/32/25657_2.png) [@Jon\_D](https://discuss.elastic.co/u/Jon_D)\
**Post date:** [February 12, 2018, 3:52pm UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/4 "2018-02-12T15:52:37Z")

</div>

Is Logstash running on the same machine as Elasticsearch? I'd suggest you check if Elasticsearch is listening, for example by using `curl -XGET "192.168.201.30:9200/"`. This should return basic information about your Elasticsearch node running on that address and the cluster it belongs to.

---

<div class="post-metadata">

**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\
**Post date:** [February 13, 2018, 7:18am UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/5 "2018-02-13T07:18:51Z")

</div>

Yes, logstash i running on same machine as ES.  
Command curl work:

```
{
  "name" : "syslogSTORE",
  "cluster_name" : "syslog",
  "cluster_uuid" : "x63VkzfJTtSndsx4v7ucEg",
  "version" : {
    "number" : "5.6.7",
    "build_hash" : "4669214",
    "build_date" : "2018-01-25T21:14:50.776Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.1"
  },
  "tagline" : "You Know, for Search"
}
cadmin@syslog:~$
```

---

<div class="post-metadata">

**Author:** ![Jon\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jon_d/32/25657_2.png) [@Jon\_D](https://discuss.elastic.co/u/Jon_D)\
**Post date:** [February 13, 2018, 7:24am UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/6 "2018-02-13T07:24:56Z")

</div>

Can you telnet to this machine on 192.168.201.30 port 9200 from another machine in the same network?

---

<div class="post-metadata">

**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\
**Post date:** [February 13, 2018, 7:38am UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/7 "2018-02-13T07:38:08Z")

</div>

Yes, telnet is working from another machine.

---

<div class="post-metadata">

**Author:** ![Jon\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jon_d/32/25657_2.png) [@Jon\_D](https://discuss.elastic.co/u/Jon_D)\
**Post date:** [February 13, 2018, 9:14am UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/8 "2018-02-13T09:14:18Z")

</div>

> [@Tade](#):
>
> index =\> "new"

Can you remove this from the pipeline config or put it inside the elasticsearch {} output?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2018, 9:29am UTC](https://discuss.elastic.co/t/logstash-join-to-es-error/119492/9 "2018-03-13T09:29:03Z")

</div>

Closed on March 13, 2018, 9:29am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.