# Logstash to elasticsearch service

**URL:** <https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626>\
**Category:** Logstash\
**Created:** [March 29, 2021, 5:29am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626 "2021-03-29T05:29:06Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 5:29am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/1 "2021-03-29T05:29:06Z")

</div>

Hi everyone,  
I'm on my trial to test elasticcloud. But now I got problem to create pipeline from logstash to elasticcloud. Here is my logstash.conf output

```auto
output {
        stdout{codec=>rubydebug}
        elasticsearch
        {
            hosts=>["https://<clusterid>.asia-southeast1.gcp.cloud.es.io:9243"]
 index=>"testindex"
user=>elasticdeploymentcredentials
password=>elasticdeploymentcredentials
 }
}

```

But it always returning error as:

```auto
[WARN] 2021-03-29 12:24:50.148 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io"}
[WARN] 2021-03-29 12:24:55.158 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io: Name or service not known"}
[WARN] 2021-03-29 12:25:00.163 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io"}
[WARN] 2021-03-29 12:25:05.170 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io: Name or service not known"}
[WARN] 2021-03-29 12:25:10.175 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io"}

```

following some steps from [connecting logstash to elastic cloud](https://discuss.elastic.co/t/connecting-logstash-to-elastic-cloud/128362)

following instruction of warkolm, I test to curl it and it successfully returning

```auto
 "name" : "instance-0000000001",
  "cluster_name" : "<clusterid>",
  "cluster_uuid" : "<clusteruuid>",
  "version" : {
    "number" : "7.12.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "78722783c38caa25a70982b5b042074cde5d3b3a",
    "build_date" : "2021-03-18T06:17:15.410153305Z",
    "build_snapshot" : false,
    "lucene_version" : "8.8.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

am I missing something?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 29, 2021, 6:28am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/2 "2021-03-29T06:28:36Z")

</div>

Can you curl the cluster with those user credentials?

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 6:46am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/3 "2021-03-29T06:46:42Z")

</div>

Hi Warkolm, thank you for your reply.  
`[root@localhost testconfig]# curl https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.elastic-cloud.com:9243`  
returning

```auto
https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.elastic-cloud.com:9243
{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 29, 2021, 6:58am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/4 "2021-03-29T06:58:32Z")

</div>

Then your credentials are incorrect, you may need to reset them.

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 7:02am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/5 "2021-03-29T07:02:23Z")

</div>

```auto
  "name" : "instance-0000000001",
  "cluster_name" : "<clusterid>",
  "cluster_uuid" : "<clusteruuid>",
  "version" : {
    "number" : "7.12.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "78722783c38caa25a70982b5b042074cde5d3b3a",
    "build_date" : "2021-03-18T06:17:15.410153305Z",
    "build_snapshot" : false,
    "lucene_version" : "8.8.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

reupdate my credentials. and update on logstash.conf password too. it returning

```auto
[WARN] 2021-03-29 13:59:00.051 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io: Name or service not known"}
[WARN] 2021-03-29 13:59:05.058 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io"}
[WARN] 2021-03-29 13:59:10.065 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io: Name or service not known"}
[WARN] 2021-03-29 13:59:15.071 [Ruby-0-Thread-9: :1] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticdeploymentcredentials:elasticdeploymentcredentials@<clusterid>.asia-southeast1.gcp.cloud.es.io:9243/][Manticore::ResolutionFailure] <clusterid>.asia-southeast1.gcp.cloud.es.io"}

```

Please kindly help me.

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/6 "2021-03-29T07:25:19Z")

</div>

Where do I can see the url of my elasticsearch service?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 29, 2021, 8:45am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/7 "2021-03-29T08:45:46Z")

</div>

Check out [Work with Elasticsearch | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-working-with-elasticsearch.html)

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/8 "2021-03-29T08:49:32Z")

</div>

Dear walkolm, I've remake my configuration file and fill it with the right credentials, the curl also work. But the logstash conf still not working. Do you have any other solution? Thank you so much

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 29, 2021, 8:53am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/9 "2021-03-29T08:53:51Z")

</div>

Have you set up your username and password as string as shown [here](https://www.elastic.co/guide/en/cloud/current/ec-logstash.html)?

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 9:05am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/10 "2021-03-29T09:05:44Z")

</div>

Hi Christian, thank you for reply. I've add the user and password.

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 29, 2021, 10:32am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/11 "2021-03-29T10:32:13Z")

</div>

I'm so sorry, I've checked it out and I don't understand the instruction.

### Before you begin

On the **Overview** page for your new cluster in the [Elasticsearch Service Console](https://cloud.elastic.co/?baymax=docs-body&elektra=docs), copy the Elasticsearch endpoint URL under **Endpoints**.

It only shows, Copy end point and copy cluster id. So I have to create my own.  
End point could be shown like

```auto
https://i-o-optimized-deployment.es.asia-southeast1.gcp.elastic-cloud.com:9243

```

To create the hosts above, I Change **i-o-optimized-deployment** with **cluster id** manually. Then change domain **[elastic-cloud.com](http://elastic-cloud.com)** into **[cloud.es.io](http://cloud.es.io)**. I also remove **es** before region.  
So my hosts become

```auto
https://<clusterid>.asia-southeast1.gcp.cloud.es.io:9243

```

still not working 😕

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 29, 2021, 11:06am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/12 "2021-03-29T11:06:01Z")

</div>

You need to get the correct URL/endpoint from the console and make sure you are copying the Elasticsearch URL and not the Kibana one. I believe this should contain your cluster ID and that you should use it exactly as is.

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [March 30, 2021, 2:50am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/13 "2021-03-30T02:50:50Z")

</div>

Dear @Christian_Dahlqvist , much thanks for your assistance. I've found the problem.  
the url should be  
`"https://<clusterid>.es.asia-southeast1.gcp.elastic-cloud.com:9243"`  
instead of  
`https://<clusterid>.asia-southeast1.gcp.cloud.es.io:9243`

and much thanks for @warkolm for your assistance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2021, 2:51am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-service/268626/14 "2021-04-27T02:51:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.