# Not able to connect to AWS monitor instance thru proxy
**URL:** https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721
**Category:** Beats
**Tags:** metricbeat
**Created:** [May 14, 2020, 10:24pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721 "2020-05-14T22:24:42Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Roberto\_Chacon](https://discuss.elastic.co/u/Roberto_Chacon)
#### Post date: [May 14, 2020, 10:24pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/1 "2020-05-14T22:24:42Z")
I'm trying to connect to AWS instance for monitoring using metricbeat but getting an error "proxyconnect tcp: tls: first record does not look like a TLS handshake". When trying to test it with curl seems that is working.
Anyone have any ideas what can be the issue.
Metricbeat version: 7.6
Here is my configuration
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["[http://AWS](http://AWS) [instace.us-west-1.aws.found.io:443](http://instace.us-west-1.aws.found.io:443)"]
username: "cloud\_monitoring\_agent"
password: "xxxxx"
proxy\_url: "[https://proxy.domain.com:3128](https://proxy.domain.com:3128)"
#proxy\_disable: true
proxy\_disable: false
# Protocol - either `http` (default) or `https`.
#protocol: "https"
This is the outputs I've got.
Output
May 14 21:18:27 server metricbeat: 2020-05-14T21:18:27.191Z#011INFO#011pipeline/output.go:95#011Connecting to backoff(elasticsearch([http://AWS](http://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443)))
May 14 21:18:28 server metricbeat: 2020-05-14T21:18:28.495Z#011ERROR#011pipeline/output.go:100#011Failed to connect to backoff(elasticsearch([http://AWS](http://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))): Get http://.us-west-1.aws.found.io:443: proxyconnect tcp: tls: first record does not look like a TLS handshake
May 14 21:18:28 server metricbeat: 2020-05-14T21:18:28.495Z#011INFO#011pipeline/output.go:93#011Attempting to reconnect to backoff(elasticsearch(http://.us-west-1.aws.found.io:443)) with 1 reconnect attempt(s)
May 14 21:18:30 server metricbeat: 2020-05-14T21:18:30.501Z#011ERROR#011pipeline/output.go:100#011Failed to connect to backoff(elasticsearch([http://AWS](http://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))): Get http://.us-west-1.aws.found.io:443: proxyconnect tcp: tls: first record does not look like a TLS handshake
* * *
Curl output
'# curl -u cloud\_monitoring\_agent:xxxxxx -x [https://proxy.domain.com:3128](https://proxy.domain.com:3128) https://.us-west-1.aws.found.io:443
{
"name" : "instance-0000000001",
"cluster\_name" : "",
"cluster\_uuid" : "",
"version" : {
"number" : "7.3.0",
"build\_flavor" : "default",
"build\_type" : "tar",
"build\_hash" : "de777fa",
"build\_date" : "2019-07-24T18:30:11.767338Z",
"build\_snapshot" : false,
"lucene\_version" : "8.1.0",
"minimum\_wire\_compatibility\_version" : "6.8.0",
"minimum\_index\_compatibility\_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [May 14, 2020, 10:36pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/2 "2020-05-14T22:36:35Z")
Hello @Roberto_Chacon
I think the problem is because there's a missing `s` in `hosts`:
```auto
hosts: ["https://AWS instace.us-west-1.aws.found.io:443"]
```
---
### Author:  [@Roberto\_Chacon](https://discuss.elastic.co/u/Roberto_Chacon)
#### Post date: [May 14, 2020, 11:02pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/3 "2020-05-14T23:02:24Z")
Hi @Luca_Belluccini
Seems that I miss that while testing, but adding the s to https is not helping
> metricbeat: 2020-05-14T22:59:16.585Z#011ERROR#011pipeline/output.go:100#011Failed to connect to backoff(elasticsearch([https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))): Get [https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443): proxyconnect tcp: tls: first record does not look like a TLS handshake
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [May 14, 2020, 11:17pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/4 "2020-05-14T23:17:28Z")
When you are running `metricbeat` or `curl`, do you have any `HTTP_PROXY` or `HTTPS_PROXY` or `NO_PROXY` environment variable set (can be lower or upper case)?
Can you share your `metricbeat.yml` file with the correct indentation (concealing the sensitive parts)?
---
### Author:  [@Roberto\_Chacon](https://discuss.elastic.co/u/Roberto_Chacon)
#### Post date: [May 15, 2020, 4:40pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/5 "2020-05-15T16:40:21Z")
No variable set
> '# echo $http\_proxy
>
> '# echo $HTTP\_PROXY
>
> '# echo $https\_proxy
>
> '# echo $HTTPS\_PROXY
>
> '# echo $NO\_PROXY
>
> '# echo $no\_proxy
>
> '#
Here is the config file: [https://pastebin.com/NTbGELyq](https://pastebin.com/NTbGELyq)
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [May 15, 2020, 8:01pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/6 "2020-05-15T20:01:50Z")
I'm sorry I am going to ask to perform the test but I am not on my laptop.
Can you try with:
```auto
output.elasticsearch:
hosts: ["AWS instance.us-west-1.aws.found.io:443"]
username: "cloud_monitoring_agent"
password: "xxxxxx"
proxy_url: "https://proxy.domain.com:3128"
protocol: "https"
```
Also, if possible, run Filebeat with `-d '*'`
---
### Author:  [@Roberto\_Chacon](https://discuss.elastic.co/u/Roberto_Chacon)
#### Post date: [May 15, 2020, 10:01pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/7 "2020-05-15T22:01:01Z")
Please find the output with the protocol flag as suggetested.
> 2020-05-15T21:54:57.690Z ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch([https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))): Get [https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443): proxyconnect tcp: tls: first record does not look like a TLS handshake
> 2020-05-15T21:54:57.690Z INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch([https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))) with 3 reconnect attempt(s)
> 2020-05-15T21:54:57.690Z DEBUG [elasticsearch] elasticsearch/client.go:733 ES Ping(url=[https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443))
> 2020-05-15T21:54:57.695Z DEBUG [elasticsearch] elasticsearch/client.go:737 Ping request failed with: Get [https://AWS](https://AWS) [instance.us-west-1.aws.found.io:443](http://instance.us-west-1.aws.found.io:443): proxyconnect tcp: tls: first record does not look like a TLS handshake
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2020, 10:01pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-aws-monitor-instance-thru-proxy/232721/8 "2020-06-12T22:01:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.