title: Cannot connect LogStash to AWS ElasticSearch "Attempted to resurrect connection to dead ES instance, but got an error"
body: <p>I am building a setup which consists of AWS ElasticSearch (includes both ElasticSearch and Kibana), LogStash and FileBeat. I have been following <a href="https://sysadmins.co.za/setup-a-logstash-server-for-amazon-elasticsearch-service-and-auth-with-iam/" rel="nofollow noreferrer">this tutorial</a> which explains how to Setup a Logstash Server for Amazon Elasticsearch Service and Auth with IAM.</p>
  <p>I am using an Ubuntu 18.04 EC2 m4.large instance to host both LogStash and FileBeat. I have provisioned all of my assets inside a VPC. So far, I have provisioned an AWS ES domain, an Ubuntu 18.04 EC2 and then installed LogStash inside that. Right now, I am ignoring FileBeat and I just want to connect my LogStash service to the AWS ES domain.</p>
  <p>As per the tutorial, I have</p>
  <ol>
  <li>Created an IAM Access Policy</li>
  <li>Created Role logstash-system-es with &quot;ec2.amazonaws.com&quot; as trusted entity</li>
  <li>Authorized the Role in my AWS ES domain dashboard</li>
  <li>Installed LogStash and configured as specified
  (Here I entered the Access Key I am using and its ID into the output section. However, I am not sure how the Role and an Access Key relates to each other)</li>
  <li>Started LogStash and tailed the logstash-plain.log file to see the output</li>
  </ol>
  <p>When I check the output it appears LogStash cannot connect to the ES domain.The following line starts occurring infinitely. (I have replaced the AWS ES domain name with <em><em>AWSESDOMAIN</em></em>).</p>
  <blockquote>
  <p>Attempted to resurrect connection to dead ES instance, but got an
  error.
  {:url=&gt;&quot;https://vpc-<em><em>AWSESDOMAIN</em></em>.us-east-1.es.amazonaws.com:443/&quot;,
  :error_type=&gt;LogStash::Outputs::AmazonElasticSearch::HttpClient::Pool::BadResponseCodeError,
  :error=&gt;&quot;Got response code '403' contacting Elasticsearch at URL
  'https://vpc-<em><em>AWSESDOMAIN</em></em>.us-east-1.es.amazonaws.com:443/'&quot;}</p>
  </blockquote>
  <p>FYI I have configured my AWS ES domain with Fine Grained Access Control when setting it up.</p>
  <p>What seems to be the issue here? Is it regarding Fine Grained Access Control? Security Groups? IAM issue?</p>