# Can not restart logstash service after configured syslog.conf

**URL:** <https://discuss.elastic.co/t/can-not-restart-logstash-service-after-configured-syslog-conf/265335>\
**Category:** Logstash\
**Created:** [February 24, 2021, 12:03pm UTC](https://discuss.elastic.co/t/can-not-restart-logstash-service-after-configured-syslog-conf/265335 "2021-02-24T12:03:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![testsemd\_email](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testsemd_email/32/82657_2.png) [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\
**Post date:** [February 24, 2021, 12:03pm UTC](https://discuss.elastic.co/t/can-not-restart-logstash-service-after-configured-syslog-conf/265335/1 "2021-02-24T12:03:28Z")

</div>

I was able to install logstash on the ubuntu server.  
Then I configued the syslog.conf file to get the traffic to elasticsearch(installed in same server).  
Then tried to restart the logstash service, but unable to restart the logstash service and logstash service was down.

Syslog data traffic is coming as CEF format to logstash.  
syslog.conf file as bellow:

input {  
tcp {  
port =\> 514  
type =\> "syslog"  
codec =\> cef { delimiter =\> "\r\n" }  
}

}

filter {  
}

output {  
if [type] == "syslog" {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> "localhost:9200"  
user =\> "elastic"  
password =\> "XXXXXXX"  
http\_compression =\> "true"  
index =\> "syslog-%{+YYYY.MM.dd}"  
}  
}  
}  
I'm using ELK 7.10.1 version  
logstash log:

 ![logstash error](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61afa3388b6d97d09d262c08060b576dfef0ca03.jpeg)

elasticsearch log:

 ![ela](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b6499e7fb473b23a5904597c26a1f5cbde1b3ae.jpeg)

Thank You!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2021, 12:04pm UTC](https://discuss.elastic.co/t/can-not-restart-logstash-service-after-configured-syslog-conf/265335/2 "2021-03-24T12:04:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.