Logstash not being monitored after I installed new licenses on ES nodes

Hello I am using 5.6.12 Logstash, ES, and kibana (cannot use newer stuff wish I could)

Essentially I had everything working fine with my configs until I had to update my license for ES.
i used the command in docs to send new license to ES nodes (the license was official directly from Elasticsearch representative. I can monitor my ES datanodes fine and see them in GUI kibana. I do not see logstash and I am receiving this error.

[2019-01-09T20:47:03,514][WARN ][logstash.licensechecker.xpackinfo] Nil response from License Server
[2019-01-09T20:47:04,119][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@10.70.70.114:9202/, :path=>"/"}
[2019-01-09T20:47:04,128][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_system:xxxxxx@10.70.70.114:9202/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@10.70.70.114:9202/][Manticore::ClientProtocolException] 10.70.70.114:9202 failed to respond"}

I used:
curl -XPUT -u elastic 'http://<host>:<port>/_xpack/license' -H "Content-Type: application/json" -d @license.json

to update both ES nodes and I havent changed anything in my configuration files or pipeline file. Any idea on how I can get logstash to recognize new license ?

thank you please assist me

This doesn't look related to licensing at first sight.

  • Is there an Elasticsearch node running on 10.70.70.114 ? Is it listening on port 9202 ( http layer ) ?
  • Is that Elasticseach node healthy? Can you check its logs, I'd expect to find some ERROR messages or some indication that it is not running
  • Did something change in your network? Can you access 10.70.70.114 from the machine running Logstash?

I resolved the issue in a weird way by setting pack.security.http.ssl.enabled: from true to false in all YML files. this locked me out from Kibana so I changed them all back to true and now logstash is being monitored again.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.