# X PACK CONFIGURATION **URL:** \ **Category:** Logstash\ **Created:** [June 7, 2019, 12:54pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758 "2019-06-07T12:54:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Debasish\_Rath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debasish_rath/32/45380_2.png) [@Debasish\_Rath](https://discuss.elastic.co/u/Debasish_Rath)\ **Post date:** [June 7, 2019, 12:54pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/1 "2019-06-07T12:54:41Z")
I am using Redhat version 7.0 (Maipo). I am trying to install XPack on ELK. I got success in ELK and Kibana. But when I am trying to run config file below error is coming. ``` [2019-06-07T13:48:05,392][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]} [2019-06-07T13:48:05,394][INFO][logstash.pipeline] Starting pipeline {:pipeline_id=>".monitoring-logstash", "pipeline.workers"=>1, "pipeline.batch.size"=>2, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>2, :thread=>"#"} [2019-06-07T13:48:05,462][INFO][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}} [2019-06-07T13:48:05,463][INFO][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"} [2019-06-07T13:48:05,467][WARN][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)"} [2019-06-07T13:48:05,475][WARN][logstash.licensechecker.licensereader] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused) {:url=>http://localhost:9200/, :error_message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)", :error_class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"} Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused) [2019-06-07T13:48:05,476][ERROR][logstash.licensechecker.licensemanager] Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused)", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError"} [2019-06-07T13:48:05,477][WARN][logstash.licensechecker.xpackinfo] Nil response from License Server ``` Further below is my config file. I am using 6.0.1 version and at the beginner stage. Request you to help on getting the step by step XPack installation process. ☹ ``` input { file { path => "/var/application/logs/osbserver1.log" } } filter { grok { patterns_dir => "/home/ELK/logstash-6.0.1/pattern/patterm" break_on_match => false match => ["message" ,"%{osb}"] } if [EventType] == "BEGIN" and [eventType] != "OUTBOUND" and [eventType] != "INBOUND" { mutate{ add_tag => "taskbegin" } } mutate{ add_field => { "StartTime" => "%{logtime}.%{ms}" } remove_field => ["logtime","ms"] } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestHeader/GeneralConsumerInformation/consumerID/text()",consumerID] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestHeader/GeneralConsumerInformation/correlationID/text()",correlationID] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestHeader/GeneralConsumerInformation/RequestBody/payingCustomerID/text()",payingCustomerID] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestBody/amount/text()",amount] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestBody/channelId/text()",channelId] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["/RequestBody/productId/text()",productId] force_array => "false" store_xml => "false" } xml{ target => "data" source => "payload" remove_namespaces => "true" xpath => ["//RequestBody/externalTransactionID/text()",externalTransactionID] force_array => "false" store_xml => "false" } mutate { add_field => { "token" => "kNBDTnesOnWvUhhhwiVYbBZiqWZaQvYd" } } } output { elasticsearch { hosts => ["192.168.41.4:9200"] user => elastic password => elastic index => "logstash-*" } } ``` ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [June 7, 2019, 2:18pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/2 "2019-06-07T14:18:11Z")
Hi @Debasish_Rath Make sure that elasticsearch is reachable ``` Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused (Connection refused) ``` ---
**Author:** ![Debasish\_Rath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debasish_rath/32/45380_2.png) [@Debasish\_Rath](https://discuss.elastic.co/u/Debasish_Rath)\ **Post date:** [June 7, 2019, 2:47pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/3 "2019-06-07T14:47:28Z")
Thanks for the replay. elastic search is configured in 192.168.41.4 ip, but it's calling local host. Can you please let me know where I need to change it. ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [June 7, 2019, 7:23pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/4 "2019-06-07T19:23:47Z")
How you are running logstash, could you provide the commande line used (logstash -f configfile ....) ? Your config output is using hosts =\> ["192.168.41.4:9200"] but logstash log saying that you are using New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[http://localhost:9200](http://localhost:9200)"]} ---
**Author:** ![Debasish\_Rath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debasish_rath/32/45380_2.png) [@Debasish\_Rath](https://discuss.elastic.co/u/Debasish_Rath)\ **Post date:** [June 7, 2019, 7:33pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/5 "2019-06-07T19:33:14Z")
I am running logstash and config file usinf below command: `bin/logstash -f a.conf` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2019, 7:41pm UTC](https://discuss.elastic.co/t/x-pack-configuration/184758/6 "2019-07-05T19:41:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.