# Logstash to Elastic Cloud error 400

**URL:** <https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524>\
**Category:** Elasticsearch\
**Created:** [June 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524 "2020-06-17T19:10:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zee67](https://avatars.discourse-cdn.com/v4/letter/z/96bed5/32.png) [@zee67](https://discuss.elastic.co/u/zee67)\
**Post date:** [June 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524/1 "2020-06-17T19:10:18Z")

</div>

Trying to connect Logstash to Elastic Cloud but getting error 400. My Logstash config is below, any help appreciated.

input {  
tcp {  
port =\> 9600  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp}  
%{SYSLOGHOST:syslog\_hostname}  
%{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?:  
%{GREEDYDATA:syslog\_message}" }  
}

}

output {  
elasticsearch {  
hosts =\> ["https://$our\_elastic\_url.aws.found.io:9243"]  
user =\> "elastic"  
password=\> "$password"  
}  
}

_ **Logtash Error** _

[WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[https://elastic](https://elastic):xxxxxx@$our\_elastic\_url.us-east-1.aws.found.io:9243/", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '400' contacting Elasticsearch at URL 'https://$our\_elastic\_url.us-east-1.aws.found.io:9243/'"}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2020, 7:10pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524/2 "2020-07-15T19:10:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.