# Logstash "sniffing" argument in the output configuration

**URL:** <https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252>\
**Category:** Logstash\
**Created:** [October 26, 2018, 7:28pm UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252 "2018-10-26T19:28:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ggoodenough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ggoodenough/32/39061_2.png) [@ggoodenough](https://discuss.elastic.co/u/ggoodenough)\
**Post date:** [October 26, 2018, 7:28pm UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252/1 "2018-10-26T19:28:34Z")

</div>

I'm currently in the throws of implementation and come across something confusing. Hopefully one of you experts can help me out.

First, my output code block which is in a separate file from the inputs: 90-ES\_output.conf

output {  
elasticsearch {  
hosts =\> ["roundrobindns.mydomain.local:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

In this configuration, if I tail the logs, I get several (one every 2 seconds or so) of these messages:

Oct 26 19:10:09 myserver logstash[9785]: [2018-10-26T19:10:09,899][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://127.0.0.1:9200/](http://127.0.0.1:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://127.0.0.1:9200/](http://127.0.0.1:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}

Prior to that logstash is happy to start on my default beats port and query my cluster of elasticsearch boxes. It doesn't seem that logstash functionality is inhibited or problematic with this error. However, if I drop the 'sniffing =\> true' from my code block, the 'tail'ed syslog no longer produces that error.

Is it by design that sniffing for new cluster nodes looks for the loopback?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 26, 2018, 8:05pm UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252/2 "2018-10-26T20:05:54Z")

</div>

Probably the X-Pack monitoring URL setting in logstash.yml that causes this.

---

<div class="post-metadata">

**Author:** ![ggoodenough](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ggoodenough/32/39061_2.png) [@ggoodenough](https://discuss.elastic.co/u/ggoodenough)\
**Post date:** [October 26, 2018, 8:11pm UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252/3 "2018-10-26T20:11:51Z")

</div>

I read some posts about that and configured my logstash.yml accordingly (at least I think so). Full disclosure, I haven't read enough on what the free version of xpack includes and what it doesn't in terms of how I need to configure my \*.yml files.

I do have these lines in my logstash.yml configured as such:

xpack.monitoring.enabled: false  
xpack.monitoring.elasticsearch.url: ["roundrobindns.mydomain.local:9200"]

xpack.management.enabled: false  
xpack.management.elasticsearch.url: ["roundrobindns.mydomain.local:9200"]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 27, 2018, 9:41am UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252/4 "2018-10-27T09:41:30Z")

</div>

Well, that looks correct (if those really are the settings in use).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2018, 9:50am UTC](https://discuss.elastic.co/t/logstash-sniffing-argument-in-the-output-configuration/154252/5 "2018-11-24T09:50:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.