Logstash无法连接Elasticsearch问题排查求助

同一机器部署Elasticsearch、Kibana和Logstash，配置Logstash连接Elasticsearch时出现主机无法解析错误，Kibana可正常连接ES，Logstash.yml使用默认配置，环境采用HTTP协议，尝试过带/不带认证的配置均无效。

错误日志 #

[2024-05-03T16:15:44,009][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elastic:xxxxxx@locahost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://locahost:9200/][Manticore::ResolutionFailure] locahost"}
[2024-05-03T16:15:51,704][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"No such host is known (locahost)", :exception=>Manticore::ResolutionFailure, :cause=>#<Java::JavaNet::UnknownHostException: No such host is known (locahost)>}
[2024-05-03T16:15:51,706][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elastic:xxxxxx@locahost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://locahost:9200/][Manticore::ResolutionFailure] No such host is known (locahost)"}
[2024-05-03T16:15:54,751][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"locahost", :exception=>Manticore::ResolutionFailure, :cause=>#<Java::JavaNet::UnknownHostException: locahost>}
[2024-05-03T16:15:54,754][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elastic:xxxxxx@locahost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://locahost:9200/][Manticore::ResolutionFailure] locahost"}
[2024-05-03T16:15:59,789][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"locahost", :exception=>Manticore::ResolutionFailure, :cause=>#<Java::JavaNet::UnknownHostException: locahost>}
[2024-05-03T16:15:59,791][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://elastic:xxxxxx@locahost:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://locahost:9200/][Manticore::ResolutionFailure] locahost"}

当前配置 #

Logstash配置（logstash.conf） #

input
{
  stdin{}
}
output
{
  stdout
  {
    codec => rubydebug
  }
  elasticsearch
  {
    hosts => ["locahost:9200"]
    index => "this_log_index_name"
    user => "elastic"
    password => "P@ssw0rd"
  }
}

Elasticsearch配置（elasticsearch.yml） #

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
#network.host: 192.168.0.1
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
discovery.type: single-node
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false

检查错误日志和Logstash配置后，可发现核心问题是主机名拼写错误：

• 错误日志中反复出现的locahost
• Logstash配置里的hosts => ["locahost:9200"]

正确的本地主机名是localhost（字母顺序为l-o-c-a-l-h-o-s-t），将Logstash配置中的locahost修改为localhost即可解决问题。修改后的Elasticsearch输出配置如下：

elasticsearch
{
  hosts => ["localhost:9200"]
  index => "this_log_index_name"
  user => "elastic"
  password => "P@ssw0rd"
}

也可以直接使用IP地址127.0.0.1:9200替代主机名，彻底避免拼写错误问题。

内容的提问来源于stack exchange，提问作者attack