Unable to start logstash service error code in log

Elastic Stack Logstash
1

Hi there,

When I try to start logstash "systemctl start logstash" I see these error messages in the log:

[2018-04-04T21:46:39,189][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://127.0.0.1:9200/"}
[2018-04-04T21:46:43,902][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://elasticsearch:changeme@:9200/, :path=>"/"}
[2018-04-04T21:46:43,909][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticsearch:changeme@:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticsearch:changeme@:9200/][Manticore::ClientProtocolException] URI does not specify a valid host name: https:/"}
[2018-04-04T21:46:48,912][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://elasticsearch:changeme@:9200/, :path=>"/"}

2

Hi Erik,

Could you post some informations?

  • What version of Logstash?
  • How did you install Logstash (e.g., package from elastic.co, from source, deb or rpm package etc)?
  • What is your operating system?

Could you post your output config from logstash config file?

3

The above is not a valid URL; it contains no hostname. Do you have a module configured incorrectly your logstash.yml?

4

Thank you both for the reply. Considering questions about versions and operating system:

  • Logstash version 6.2.3
  • install base is a yum repo "baseurl=https://artifacts.elastic.co/packages/6.x/yum"
  • OS is CentOS Linux release 7.4.1708 (Core)

Output config:

output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

logstash.yml:

Everything is commented out except:

path.data: /var/lib/logstash
path.logs: /var/log/logstash

It makes sense that the URL is not valid. But I can't find where it's defined?

5

check the logs of filebeat or run filebeat -e -d "*" command on the terminal.
check whether logstash is getting input or not. and also the check the pattern in that output logstash config file .

6

Hello, filebeat doesn't return anything, no matter what command for example "filebeat version" nothing returned. It look's like filebeat needs reinstalling. Is there a way to bypass filebeat in the logstash output?

7

Eh, actually I've found another output file in /logstash/conf.d/

output {
elasticsearch {
hosts => ["https:localhost:5601"]
user => "elasticsearch"
password => "changeme"
index => "syslog-%{+YYYY.MM.dd}"
document_type => "system_logs"
}
stdout { codec => rubydebug }
}

Notice the typo @hosts :blush:

8

I took out the user and password from the config file and changed https into http.

No the error message I get is : [http://localhost:5601/][Manticore::SocketException] Connection refused

Next I do : curl http://localhost:9200 all good..

9

@heskez this url for hosts is wrong because this url is the Kibana.
On logstash output is necessary to config an elasticsearch url valid like hosts => ["localhost:9200"].

I suggest you change the hosts for hosts => ["localhost:9200"] in this logstash config file and try again.

10

Changed the port to 9200 and done no more error messages. Thanks

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.