Logstash.licensechecker.licensereader: elasticsearch: Name or service not known

[pocketcolin (Colin Ulin)]

Apologies for all of the questions recently and huge thanks to everyone who has responded and helped me get this far. At this point I have logs being passed from a Render web server to a private service running Logstash (v8.6.2) in a docker cluster on Render (via a TCP connection) and Logstash successfully passes everything along to Elasticsearch hosted on Elastic Cloud. My only remaining issue is this repeated error message from the logstash licensereader. The following logs start showing up once my Logstash server starts:

Feb 24 01:07:45 PM  Your service is live 🎉
Feb 24 01:08:05 PM  [2023-02-24T18:08:05,173][INFO ][logstash.licensechecker.licensereader] Failed to perform request {:message=>"elasticsearch: Name or service not known", :exception=>Manticore::ResolutionFailure, :cause=>#<Java::JavaNet::UnknownHostException: elasticsearch: Name or service not known>}
Feb 24 01:08:05 PM  [2023-02-24T18:08:05,175][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elasticsearch:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://elasticsearch:9200/][Manticore::ResolutionFailure] elasticsearch: Name or service not known"}
Feb 24 01:08:05 PM  [2023-02-24T18:08:05,192][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"No Available connections"}
Feb 24 01:08:35 PM  [2023-02-24T18:08:35,192][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"No Available connections"}

If Logstash is able to send my logs onto Elasticsearch, why is the licensechecker failing?

default.conf

input {
    tcp {
        port => "10000"
    }
}

filter {
    json {
        source => "message"
    }
}

output {
    elasticsearch {
        cloud_id => "${CLOUD_ID}"
        cloud_auth => "${CLOUD_AUTH}"
        data_stream => "true"
    }
}

Dockerfile

FROM docker.elastic.co/logstash/logstash:8.6.2

RUN rm -f /usr/share/logstash/pipeline/default.conf

COPY pipeline/ /usr/share/logstash/pipeline/

[stephenb (Stephen Brown)]

@pocketcolin

Feb 24 01:08:05 PM  [2023-02-24T18:08:05,175][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elasticsearch:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://elasticsearch:9200/][Manticore::ResolutionFailure] elasticsearch: Name or service not known"}

Do you have more than 1 *.conf file in that in that directory?

Logstsash will try to read them all.... perhaps you have a sample.conf left in there or something

[pocketcolin (Colin Ulin)]

Dang stephenb you solved it! I was about to respond and say no, but it turns out the Logstash Docker file has a default .conf file that I wasn't removing. I updated my Dockerfile to replace the old .conf file with my new one and now everything is working! You rock!