# Logstash posting to one of three ElasticSearch nodes (no connectivity problems)

**URL:** <https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359>\
**Category:** Elasticsearch\
**Created:** [November 25, 2019, 6:29pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359 "2019-11-25T18:29:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JennS](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@JennS](https://discuss.elastic.co/u/JennS)\
**Post date:** [November 25, 2019, 6:29pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/1 "2019-11-25T18:29:24Z")

</div>

I have LogStash feeding 3 ElasticSearch nodes. I am only getting output to the logs on one of them. The logs on the other two don't seem to updating at all., systemctl confirms ElasticSearch is running on all three and I can curl/telnet to port 9200 on all three machines so not a connectivity issues. I am also sending Logstash to output to file and the file looks correct.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 25, 2019, 6:35pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/2 "2019-11-25T18:35:59Z")

</div>

If you want to write to 3 different clusters you need 3 separate Elasticsearch outputs. Do you have this in your config?

---

<div class="post-metadata">

**Author:** ![JennS](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@JennS](https://discuss.elastic.co/u/JennS)\
**Post date:** [November 25, 2019, 6:50pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/3 "2019-11-25T18:50:30Z")

</div>

Yes I have three separate Elasticsearch hosts listed`

> output {  
> elasticsearch {

```
    hosts => ["10.0.1.96:9200", "10.0.1.97:9200", "10.0.1.101:9200"]
    index => "snmplogger-%{+YYYY.MM.dd}"
    template_overwrite => true
    template_name => "snmplogs"
    manage_template => true
    template => "/etc/logstash/templates/snmplogs.json"
}

```

`

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 25, 2019, 6:53pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/4 "2019-11-25T18:53:53Z")

</div>

Three outputs, not three hosts in one output.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 25, 2019, 6:57pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/5 "2019-11-25T18:57:40Z")

</div>

That load balances across three hosts, but does not send data to all three.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2019, 6:57pm UTC](https://discuss.elastic.co/t/logstash-posting-to-one-of-three-elasticsearch-nodes-no-connectivity-problems/209359/6 "2019-12-23T18:57:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.