Closed ronaldpetty closed 2 months ago
In the logstash.yml
config of the docker image, monitoring.elasticsearch.hosts: http://elasticsearch:9200
is defined where Logstash enables monitoring by default. You have no http://elasticsearch:9200
Elasticsearch host and so hitting this error.
To overcome this error, you need to either disable monitoring or set proper host, refer to this guide page:
https://www.elastic.co/guide/en/logstash/current/docker-config.html#docker-env-config
@mashhurs awesome! Thank you, it didn't dawn on me to compare the default configuration. I was hung up on the -e
acting like an (complete) override. I'll give it a shot in a little bit, thank you!
Got it working. Just for anyone else (who is green on all the various settings). I had to use XPACK_MONITORING_ENABLED=false
instead of MONITORING_ENABLED=false
. Here is my example working now:
$ docker container run -e "XPACK_MONITORING_ENABLED=false" -d -p 8080:8080 --name logstash logstash:8.13.0 -e 'input { http { port => 8080 codec => json { target => "doc" } }} output { elasticsearch { hosts => ["https://host.docker.internal:9200"] api_key => "A0R6-I4B5Jb3ztqmqrF8:URNxt_FcSFyb0utJwOQnrW" index => "twitter" document_id => "%{[doc][id]}" ssl_verification_mode => none } }'
Thank you once more @mashhurs
Logstash information:
Please include the following information:
docker pull logstash:8.13.0
Plugins installed: (
bin/logstash-plugin list --verbose
)JVM (e.g.
java -version
):container
OS version (
uname -a
if on a Unix-like system):Description of the problem including expected versus actual behavior:
Its seems logstash makes a connection (once) but then loses it. It is like host.docker.internal is there but then reloads the config and fails parsing and falls back to output elasticsearch? (just a hunch).
If I run ES in a container (docker desktop on mac) and instead run logstash with the exact same config it works (see below).
Steps to reproduce:
On MacBook
docker container run -d --name elasticsearch -p 9200:9200 -m 1GB elasticsearch:8.13.0
docker container run -d --name kibana -p 5601:5601 kibana:8.13.0
Provide logs (if relevant):
Here is where I run logstash on the host instead of a container (elasticsearch is in a container still though).
In either case, I hit logstash with curl
Its probably my setup, but just seeing the issue.