# Opposite behavior of keepalive (nginx reverse proxy on ElasticSearch)

**URL:** <https://www.ruby-forum.com/t/opposite-behavior-of-keepalive-nginx-reverse-proxy-on-elasticsearch/244111>\
**Category:** NGINX\
**Created:** [February 22, 2016, 9:53am UTC](https://www.ruby-forum.com/t/opposite-behavior-of-keepalive-nginx-reverse-proxy-on-elasticsearch/244111 "2016-02-22T09:53:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [February 22, 2016, 9:53am UTC](https://www.ruby-forum.com/t/opposite-behavior-of-keepalive-nginx-reverse-proxy-on-elasticsearch/244111/1 "2016-02-22T09:53:13Z")

</div>

I am setting up a nginx reverse proxy for ElasticSearch (with HTTP Basic  
Auth) as described in this article:

> **[Tips to secure Elasticsearch clusters for free with encryption, users, and more](https://www.elastic.co/blog/tips-to-secure-elasticsearch-clusters-for-free-with-encryption-users-and-more)**
>
> Elasticsearch security is now free. This post revisits and updates best practices for securing your clusters, including transport layer security (TLS), native and file realm authentication, authorization features, cluster and node isolation, Kibana...

This is my nginx config file:

events {  
worker\_connections 1024;  
}

http {  
upstream elasticsearch {  
server [elasticsearch.example.org:9200](http://elasticsearch.example.org:9200);  
keepalive 64;  
}

```
    server {
            listen 8080;

            location / {
                    auth_basic "ElasticSearch";
                    auth_basic_user_file /var/www/.htpasswd;

                    proxy_pass 

```

[http://elasticsearch.example.org:9200](http://elasticsearch.example.org:9200);  
proxy\_http\_version 1.1;  
proxy\_set\_header Connection “Keep-Alive”;  
proxy\_set\_header Proxy-Connection “Keep-Alive”;  
}  
}  
}

The proxy correctly forwards port 8080 to 9200, and is supposed to keep  
persistent connections (keepalive) to Elasticsearch.

This is the result of visiting either the URL  
[http://elasticsearch.example.org:9200/\_nodes/stats/http?pretty](http://elasticsearch.example.org:9200/_nodes/stats/http?pretty) or  
[http://elasticsearch.example.org:8080/\_nodes/stats/http?pretty](http://elasticsearch.example.org:8080/_nodes/stats/http?pretty) (HTTP  
authentication has already been done) in a browser:

{  
“cluster\_name” : “elasticsearch”,  
“nodes” : {  
“rIFmzNwsRvGp8kipbcwajw” : {  
“timestamp” : 1455899085319,  
“name” : “Kid Colt”,  
“transport\_address” : “[elasticsearch.example.org/10.3.3.3:9300](http://elasticsearch.example.org/10.3.3.3:9300)”,  
“host” : “10.3.3.3”,  
“ip” : [“[elasticsearch.example.org/10.3.3.3:9300](http://elasticsearch.example.org/10.3.3.3:9300)”, “NONE” ],  
“http” : {  
“current\_open” : 3,  
“total\_opened” : 28  
}  
}  
}  
}

When visiting the page on port 9200 (direct connection to Elasticsearch)  
and  
reloading, the field total\_opened is supposed to increase, while when  
visiting on port 8080 (through the nginx proxy) and reloading, the field  
should not change.

In fact, it happens the opposite. What is the reason of this strange  
behavior?

Posted at Nginx Forum:

> **[Opposite behavior of keepalive (nginx reverse proxy on ElasticSearch)](https://forum.nginx.org/read.php?2,264702,264702#msg-264702)**
>
> I am setting up a nginx reverse proxy for ElasticSearch (with HTTP Basic Auth) as described in this article: https://www.elastic.co/blog/playing-http-tricks-nginx This is my nginx config file: events { worker\_connections 1024; }