Unable to establish connection between Logstash and Elasticsearch to parse iis log files

Elastic Stack Logstash
5

Your elasticsearch output section looks like it was copied from a very old example, in fact localhost and 9200 are the defaults so they don't need to be specified. It should look something like this:

  elasticsearch {
    index => "my_index"
  }

IMO, the Logstash service is being continually restarted because the service is exiting with a configuration error message that is being logged to the journalctl logs.

You can download another copy of Logstash to a different folder and run it manually. What do you see in the console?

1 Like