None of the configured nodes are available: [{#transport#-1}{172}{172.17.0.4:9300}

Request Type

Configuration

Work Environment

Problem Description

TheHive is working with my ElasticSearch that come with Security Onion but Cortex that seem to need port 9300 TCP isn't working. The IP in the title is good and TheHive use the same but with port 9200. Elasticsearch is listening to port 9200 and 9300 and I can telnet both port but I get a connection reset with port 9300 so it look like the problem.

Is there a configuration that I need to change to let ElasticSearch port 9300 being able to get connection from Cortex docker environment ?

Thanks

Possible Solutions

Allow connection to ElasticSearch port 9300 for Cortex but how ?

Cortex configuration file application.conf
search {
index = cortex
cluster = "s02"
host = ["172.17.0.4:9300"]
}

Elasticsearch configuration file elasticsearch.yml
cluster.name: "s02"
network.host: 0.0.0.0
http.host: 0.0.0.0
transport.host: 0.0.0.0
transport.tcp.port: 9300

telnet 172.17.0.4 9300
Trying 172.17.0.4...
telnet: Unable to connect to remote host: Connection refused

Firewall (ufw) is open for port 9300 and 9200 and so on ...

lsof -i:9300 show that elasticsearch is listening also

Start with the Cortex application.conf search settings and the Elasticsearch elasticsearch.yml transport and network settings. Reproduce the connection attempt from the Cortex Docker environment on port 9300 and compare it with the reported telnet results. Done means Cortex can connect to the configured Elasticsearch node and no longer reports that none of the configured nodes are available.