# New to Logstash - can't get it to connect to my Elasticsearch **URL:** \ **Category:** Logstash\ **Created:** [November 20, 2021, 1:22am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727 "2021-11-20T01:22:22Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![aluminex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aluminex/32/97328_2.png) [@aluminex](https://discuss.elastic.co/u/aluminex)\ **Post date:** [November 20, 2021, 1:22am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727/1 "2021-11-20T01:22:22Z")
I have Elasticsearch and Kibana on a different host. I'm trying to get my Logstash instance to output to Elasticsearch on a remote host. I can forward my logs to Filebeat and then to Elastic, but I am trying to write/test a grok pattern for Mimecast logs. I've been banging my head against the wall for a couple days. I've validated that my pipeline is good. I'm guessing this is a permissions issue? Any ideas? Here is my Mimecast.conf ```auto input { file { path => "/tmp/mimecast/*.log" } } filter{ grok { match => { "message" => "%{TIMESTAMP_ISO8601:date}%{GREEDYDATA:Message}"} } } output { elasticsearch { hosts => ["172.16.200.50:9200"] index => "mimecast_index_%{+YYYYMMdd}" } } ``` And the error message ```auto [2021-11-19T16:32:42,879][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2021-11-19T16:32:43,584][INFO][org.reflections.Reflections] Reflections took 84 ms to scan 1 urls, producing 120 keys and 417 values [2021-11-19T16:32:44,878][INFO][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//172.16.200.50:9200"]} [2021-11-19T16:32:45,265][INFO][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://172.16.200.50:9200/]}} [2021-11-19T16:32:45,407][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://172.16.200.50:9200/"} [2021-11-19T16:32:45,453][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:426:in `get_es_version'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:243:in `block in healthcheck!'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:237:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:328:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:86:in `update_initial_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:80:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client.rb:344:in `build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client.rb:62:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:106:in `create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:102:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:34:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.5-java/lib/logstash/outputs/elasticsearch.rb:275:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:585:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/mimecast.conf"], :thread=>"#"} [2021-11-19T16:32:45,457][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"} [2021-11-19T16:32:45,486][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create
, action_result: false", :backtrace=>nil} [2021-11-19T16:32:45,621][INFO][logstash.runner] Logstash shut down. [2021-11-19T16:32:45,642][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.19.0.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.19.0.jar:?] at usr.share.logstash.lib.bootstrap.environment.
(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?] ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 20, 2021, 3:28am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727/2 "2021-11-20T03:28:55Z")
That error is thrown [here](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/476097712b67e0452099769b2c8b0ef6e63e40eb/lib/logstash/outputs/elasticsearch/http_client/pool.rb#L426). It is assuming that the response from Elasticsearch is JSON, with particular nested fields. If the HTTP request gets back a 4xx error it will likely have an empty body, which ends up as nil, and the attempt to reference the ["version"] entry in the thing-that-is-not-a-hash blows up. See [this](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/954) issue. Enabling log.level DEBUG may provide more useful information. The Elasticsearch logs may have more information. You do not have TLS enabled (its an http URL) so I assume you also do not have security otherwise I would suggest triple checking the user and role configurations. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 18, 2021, 3:29am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727/3 "2021-12-18T03:29:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.