XPack Cannot connect to ES


(Damian) #1

Hi, we are running multiple Logstash Instances on our parser server, running version 6.2.4. Each instance is fed by seperate RabbitMQs, and writes to a different ES index depending on the input source.

Because we are running multiple versions, I have customised logstash.yml with:

path.data: ${LS_HOME}/data/${ls_instance}

and pass in the ls_instance variable as part of the init script.

This seems to mean the xpath configuration is ignored:
xpack.monitoring.elasticsearch.url:
["eshost1:9200","eshost2:9200","eshost3:9200"]

And in the logs I now get:

[2018-05-23T14:19:38,828][INFO ][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"}
[2018-05-23T14:19:38,830][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://localhost:9200/][Manticore::SocketException] Connection refused"}

As per my above yml file, this should not be connecting to localhost, but the array of Elasticsearch servers specified.

If I remove the path.data variable (and run only one LS instance), the instance correctly sends metrics to X-Pack.

Have I missed something? Is there no way to get an instance to send logs to X-Pack if the node.name or path.data are configured?


(Damian) #2

Okay, I've figured it it.

xpack.monitoring.elasticsearch.url needs to be defined higher in the yml file than path.data or node.name.

Strange one, but hope this helps someone else :man_technologist:


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.