# Logstash + X-Pack with disabled security **URL:** \ **Category:** Logstash\ **Created:** [July 3, 2017, 9:10pm UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690 "2017-07-03T21:10:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mario\_wood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_wood/32/88001_2.png) [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Post date:** [July 3, 2017, 9:10pm UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/1 "2017-07-03T21:10:29Z")
Hi, We're setting up an ELK cluster with X-Pack installed, initially with only monitoring enabled for X-Pack. We've got everything working correctly for elasticsearch and kibana, but logstash is failing to send metrics to the elasticsearch cluster, although the elasticsearch output is working correctly and logs are being stored in the elasticsearch cluster. Is it possible to disable x-pack security for logstash in the same way as for kibana and elasticsearch? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 4, 2017, 3:32am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/2 "2017-07-04T03:32:25Z")
> [@mario\_wood](#): > > logstash is failing to send metrics to the elasticsearch cluster Can you share the error you are seeing? ---
**Author:** ![mario\_wood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_wood/32/88001_2.png) [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Post date:** [July 4, 2017, 9:07am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/3 "2017-07-04T09:07:58Z")
This is the logstash output config: ```auto output { if "metric" not in [tags] { elasticsearch { hosts => [":9200"] template => "/usr/share/logstash/bin/logstash-template-es5.json" template_overwrite => true idle_flush_time => 10 flush_size => 3000 } } if "metric" in [tags] { statsd { id => "statsd_events_rate_1m" gauge => { "events.rate_1m" => "%{[events][rate_1m]}" } port => "8125" host => "" namespace => "" sender => "" } statsd { id => "statsd_events_count" count => { "events.count" => "%{[events][count]}" } port => "8125" host => "" namespace => "" sender => "" } } } ``` and the errors we're seeing are as follows: {"level":"WARN","loggerName":"logstash.outputs.elasticsearch","timeMillis":1499159071259,"thread":"Ruby-0-Thread-5: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:224","logEvent":{"message":"Attempted to resurrect connection to dead ES instance, but got an error.","url":{"metaClass":{"metaClass":{"metaClass":{"url":"[http://logstash\_system:xxxxxx@localhost:9200/","error\_type":{"metaClass":{"metaClass":{"error\_type":"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError","error":"Elasticsearch](http://logstash_system:xxxxxx@localhost:9200/%22,%22error_type%22:%7B%22metaClass%22:%7B%22metaClass%22:%7B%22error_type%22:%22LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError%22,%22error%22:%22Elasticsearch) Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused (Connection refused)"}}}}}}}}} {"level":"INFO","loggerName":"logstash.outputs.elasticsearch","timeMillis":1499159076260,"thread":"Ruby-0-Thread-5: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.1-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:224","logEvent":{"message":"Running health check to see if an Elasticsearch connection is working","healthcheck\_url":{"metaClass":{"metaClass":{"metaClass":{"healthcheck\_url":"[http://logstash\_system:xxxxxx@localhost:9200/","path":"/](http://logstash_system:xxxxxx@localhost:9200/%22,%22path%22:%22/)"}}}}}} Part of the issue is that it is trying to connect to elasticsearch on localhost:9200, which i don't understand because the output is configured with a specific host - `:9200` - which is set to the aws elb at cfn-init, and as mentioned I am seeing logs forwarded from the logstash instance in elasticsearch - the template we're using creates a logstash-YYYY.MM.DD index. ---
**Author:** ![mario\_wood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_wood/32/88001_2.png) [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Post date:** [July 4, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/4 "2017-07-04T09:13:58Z")
Sorry it seems i'm not very smart - I missed this part of the documentation: [https://www.elastic.co/guide/en/x-pack/current/monitoring-logstash.html#CO33-1](https://www.elastic.co/guide/en/x-pack/current/monitoring-logstash.html#CO33-1) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 4, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/5 "2017-07-04T09:36:45Z")
All good, thanks for sharing the solution too 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690/6 "2017-08-01T09:36:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.