# XPack Cannot connect to ES

**URL:** <https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000>\
**Category:** Logstash\
**Created:** [May 23, 2018, 1:21pm UTC](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000 "2018-05-23T13:21:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![damianconnolly](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@damianconnolly](https://discuss.elastic.co/u/damianconnolly)\
**Post date:** [May 23, 2018, 1:21pm UTC](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000/1 "2018-05-23T13:21:51Z")

</div>

Hi, we are running multiple Logstash Instances on our parser server, running version 6.2.4. Each instance is fed by seperate RabbitMQs, and writes to a different ES index depending on the input source.

Because we are running multiple versions, I have customised logstash.yml with:

path.data: ${LS\_HOME}/data/${ls\_instance}

and pass in the ls\_instance variable as part of the init script.

This seems to mean the xpath configuration is ignored:  
xpack.monitoring.elasticsearch.url:  
["eshost1:9200","eshost2:9200","eshost3:9200"]

And in the logs I now get:

[2018-05-23T14:19:38,828][INFO][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"}  
[2018-05-23T14:19:38,830][WARN][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::SocketException] Connection refused"}

As per my above yml file, this should not be connecting to localhost, but the array of Elasticsearch servers specified.

If I remove the path.data variable (and run only one LS instance), the instance correctly sends metrics to X-Pack.

Have I missed something? Is there no way to get an instance to send logs to X-Pack if the node.name or path.data are configured?

---

<div class="post-metadata">

**Author:** ![damianconnolly](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@damianconnolly](https://discuss.elastic.co/u/damianconnolly)\
**Post date:** [May 23, 2018, 1:37pm UTC](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000/2 "2018-05-23T13:37:16Z")

</div>

Okay, I've figured it it.

xpack.monitoring.elasticsearch.url needs to be defined higher in the yml file than path.data or node.name.

Strange one, but hope this helps someone else 👨‍💻

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2018, 1:49pm UTC](https://discuss.elastic.co/t/xpack-cannot-connect-to-es/133000/3 "2018-06-20T13:49:46Z")

</div>

Closed on June 20, 2018, 1:49pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.