我有三个7.4.2elk节点，我在第一个elasticsearch/logstash/kibana节点中配置了集群，并在该节点中重新启动了elk。很成功。但一旦我在第二个elk节点中配置了集群，第一个节点的logstash就会自动停止，错误如下

An unexpected error occurred! {:error=>#<LogStash::Outputs::ElasticSearch::
    HttpClient::Pool::HostUnreachableError: Could not reach host Manticore::SocketException:
    Connection refused (Connection refused)>, :backtrace=>["/opt///logstash/vendor
    /bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/
    elasticsearch/http_client/pool.rb:293:in perform_request_to_url'", "/opt/****/****/logstash /vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs /elasticsearch/http_client/pool.rb:278:in block in perform_request'", "/opt///
    logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/
    logstash/outputs/elasticsearch/http_client/pool.rb:373:in with_connection'", " /opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib /logstash/outputs/elasticsearch/http_client/pool.rb:277:in perform_request'",
    "/opt///logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-
    java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:285:in block in Pool'", "/opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0- java/lib/logstash/outputs/elasticsearch/http_client.rb:162:in get'", "/opt///logstash/
    ndor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/
    outputs/elasticsearch/http_client.rb:378:in get_xpack_info'", "/opt/****/****/logstash/ vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/ outputs/elasticsearch/ilm.rb:57:in ilm_ready?'", "/opt///logstash/vendor/bundle
    /jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/
    ilm.rb:28:in ilm_in_use?'", "/opt/****/****/logstash/vendor/bundle/jruby/2.5.0/gems/ logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:52:in block in setup_after_successful_connection'"]}

日志中存在以下致命错误[2020-10-12t17:52:25998][error][logstash.outputs.elasticsearch][events]未能安装模板。{：消息=>“elasticsearch无法访问：[http://...：9200/][manticore:：socketexception]连接被拒绝（连接被拒绝）”，：class=>“logstash:：outputs:：elasticsearch:：httpclient:：pool:：hostunreachableerror”，：backtrace=>[“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\ u client/pool.rb:293:in perform\ u request\ u to\ u url'，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u client/pool.rb:278:in-block in-perform\u-request”“，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u-client/pool.rb:373:in-with\u-connection”“，logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u client/pool.rb:277:in perform\u request'，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u client/pool.rb:285:in block in pool'，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u client.rb:162:in get'”，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\u client.rb:378:in get\u xpack\u info'，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:57:in ilm\u ready？”，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/ilm.rb:28:in ilm\u in use？”，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/template_manager.rb:14:in install_template”“，logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:130:in install_template”“，“logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:51:in block in setup \u after \u successful \u connection”“}有什么想法吗？它是否与启用ilm\U有关？我在elasticsearch中做了如下集群更改。

cluster.name: "elasticsearch"
    node.name: "node-2"
    node.data: true
    path.logs: "/var/opt/logs/elasticsearch/"
    path.data: "/var/lib/elasticsearch"
    network.host: "**.**.**.**"
    http.port: 9200
    discovery.seed_hosts:
    - "**.**.**.**"
    - "**.**.**.**"
    cluster.initial_master_nodes:
    - "node-1"
    - "node-2"

我使用elasticsearch输出插件，在这里我添加了集群节点，如下所示。

elasticsearch 
            { 
       hosts => ["**.**.**.**:9200","**.**.**.**:9200"]
               document_id => "%{authsid}"
               index =>  "dashboard_write"
               script => "ctx._source.loginCount= params.event.get('loginCount');
                       ctx._source.contractName= params.event.get('contractName');
                        ctx._source.userName= params.event.get('userName');
                         ctx._source.sessionID= params.event.get('sessionID');
                         ctx._source.eventID= params.event.get('eventID');"
              doc_as_upsert => "true"
               action => "update"  
              ilm_enabled => false             
        }

我在第一个节点elasticsearch.yml&logstash output.conf文件中做了上述更改，并重新启动了第一个节点。它成功地出现了。然后我在第二个节点中做了相同的更改，重新启动了第二个节点，然后第一个节点的日志存储自动关闭