Sniffing is not working becose the plugin is looking for a field http_address from _nodes that does not exists anymore in ES 5.0.0
Related issue in ES 5:
According to the code file (https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/http_client/pool.rb) its looking for the field 'http_address' from the http respond_nodes (http://myelastic:9200/_nodes)
That field was removed and they are proposing to obtain the address from _nodes/http, fields http.bound_address
def check_sniff
url, resp = perform_request(:get, '_nodes')
parsed = LogStash::Json.load(resp.body)
parsed['nodes'].map do |id,info|
# TODO Make sure this works with shield. Does that listed
# stuff as 'https_address?'
addr_str = info['http_address'].to_s
next unless addr_str # Skip hosts with HTTP disabled
Looking for issues at github, i can not find anything related to this....