Unable to start logstash service error code in log

Elastic Stack Logstash
1

Hi there,

When I try to start logstash "systemctl start logstash" I see these error messages in the log:

[2018-04-04T21:46:39,189][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://127.0.0.1:9200/"}
[2018-04-04T21:46:43,902][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://elasticsearch:changeme@:9200/, :path=>"/"}
[2018-04-04T21:46:43,909][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elasticsearch:changeme@:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elasticsearch:changeme@:9200/][Manticore::ClientProtocolException] URI does not specify a valid host name: https:/"}
[2018-04-04T21:46:48,912][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://elasticsearch:changeme@:9200/, :path=>"/"}

2

Hi Erik,

Could you post some informations?

  • What version of Logstash?
  • How did you install Logstash (e.g., package from elastic.co, from source, deb or rpm package etc)?
  • What is your operating system?

Could you post your output config from logstash config file?

3

The above is not a valid URL; it contains no hostname. Do you have a module configured incorrectly your logstash.yml?

4

Thank you both for the reply. Considering questions about versions and operating system:

  • Logstash version 6.2.3
  • install base is a yum repo "baseurl=https://artifacts.elastic.co/packages/6.x/yum"
  • OS is CentOS Linux release 7.4.1708 (Core)

Output config:

output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

logstash.yml:

Everything is commented out except:

path.data: /var/lib/logstash
path.logs: /var/log/logstash

It makes sense that the URL is not valid. But I can't find where it's defined?

5

check the logs of filebeat or run filebeat -e -d "*" command on the terminal.
check whether logstash is getting input or not. and also the check the pattern in that output logstash config file .

6

Hello, filebeat doesn't return anything, no matter what command for example "filebeat version" nothing returned. It look's like filebeat needs reinstalling. Is there a way to bypass filebeat in the logstash output?

7

Eh, actually I've found another output file in /logstash/conf.d/

output {
elasticsearch {
hosts => ["https:localhost:5601"]
user => "elasticsearch"
password => "changeme"
index => "syslog-%{+YYYY.MM.dd}"
document_type => "system_logs"
}
stdout { codec => rubydebug }
}

Notice the typo @hosts :blush:

8

I took out the user and password from the config file and changed https into http.

No the error message I get is : [http://localhost:5601/][Manticore::SocketException] Connection refused

Next I do : curl http://localhost:9200 all good..

9

@heskez this url for hosts is wrong because this url is the Kibana.
On logstash output is necessary to config an elasticsearch url valid like hosts => ["localhost:9200"].

I suggest you change the hosts for hosts => ["localhost:9200"] in this logstash config file and try again.

10

Changed the port to 9200 and done no more error messages. Thanks