啟動elasticsearch後：

[[email protected] config]$ netstat -tnlp|grep java
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp6       0      0 127.0.0.1:9200          :::*                    LISTEN      22138/java          
tcp6       0
 
      0 127.0.0.1:9300          :::*                    LISTEN      22138/java    

• 1
• 2
• 3
• 4
• 5

再啟動logstash出現報錯

[[email protected] config]# logstash -f logstash-elasticsearch.conf 
OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
Sending Logstash's logs to /usr/local/logstash-5.4.0/logs which is now configured via log4j2.properties
[2017-05-25T08:05:03,717
 
][ERROR][logstash.outputs.elasticsearch] Unknown setting 'host' for elasticsearch
[2017-05-25T08:05:03,767][ERROR][logstash.agent           ] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}

• 1
• 2
• 3
• 4
• 5
• 6

其中logstash-elasticsearch.conf的配置如下：

input { stdin {} }
output {
        elasticsearch {
                host => '127.0.0.1'
 

        }
        stdout { codec => rubydebug }
}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8

解決方法： 
將配置裡面的host改為hosts，好像是因為文件的一個bug。 
修改過後連線成功：

[2017-05-25T08:16:32,965][INFO ][logstash.pipeline        ] Pipeline main started
The stdin plugin is now waiting for input:
[2017-05-25T08:16:33,156][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
{
    "@timestamp" => 2017-05-25T12:16:32.992Z,
      "@version" => "1",
          "host" => "ELK",
       "message" => "test"
}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9

In the elasticsearch input, it’s hosts no matter which version. However, in the elasticsearch output, it was host before Logstash 2.0 and then the property name has been standardized to hosts. – Val Mar 10 ‘16 at 13:22 
參考自：https://stackoverflow.com/questions/32200868/logstash-input-from-elasticsearch-error