# Logstash not allowed to talk with elasticsearch (Manticore::SocketException\]

**URL:** https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556
**Category:** Logstash
**Created:** [April 18, 2018, 2:40pm UTC](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556 "2018-04-18T14:40:46Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![skaldenmet](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@skaldenmet](https://discuss.elastic.co/u/skaldenmet)
#### Post date: [April 18, 2018, 2:40pm UTC](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556/1 "2018-04-18T14:40:46Z")

</div>

Hi,

Im using docker-elk with version 6.2.2 on my 16.04 Ubuntu Server with X-Pack.  
The issue is when i start my docker containers logstash keeps spamming:

`[WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://elastic:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://elastic:xxxxxx@localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"}`

What I've tried:  
\*I disabled the X-Pack reporting feature in the \*.yml files from ELK.  
\*I queried my elasticsearch locally to see if I am able to access it with the elastic superuser and it **worked**.

Output from my logstash.conf:  
`output { if "nessus" in [tags] or [type] == "nessus" { #stdout { codec => rubydebug } elasticsearch { hosts => ["localhost:9200"] user => "elastic" password => "xxx" index => "logstash-vulnwhisperer-%{+YYYY.MM}" } } }`

logstash.yml:  
`http.host: "0.0.0.0" path.config: /usr/share/logstash/pipeline xpack.monitoring.enabled: false`

elasticsearch.yml:  
`cluster.name: "docker-cluster" network.host: 0.0.0.0 discovery.type: single-node xpack.monitoring.enabled: false`

I'm fighting with this issue for 8 hours now and I couldn't find a fix for this.  
Please give me a spark of hope.

Regards

---

<div class="post-metadata">

### Author: ![skaldenmet](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@skaldenmet](https://discuss.elastic.co/u/skaldenmet)
#### Post date: [April 18, 2018, 3:39pm UTC](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556/2 "2018-04-18T15:39:11Z")

</div>

Solved the issue. Instead of "localhost" in logstash.conf I typed the name of the docker container who he is speaking to.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 16, 2018, 3:39pm UTC](https://discuss.elastic.co/t/logstash-not-allowed-to-talk-with-elasticsearch-manticore-socketexception/128556/3 "2018-05-16T15:39:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.