"0.0.0.0:5001", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"}
> 01:00:59.569 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}
this is the config:
```
input {
# syslog {}
udp {
port => 5001
type => "syslog"
}
}
filter {
}
output {
stdout {
codec => rubydebug
}
}
```
And I used the following docker-compose to start ELK on the server side:
```
# cat docker-compose.yml
version: '2'
services:
elasticsearch:
image: elasticsearch
ports:
- "9200:9200"
- "9300:9300"
volumes:
- ./data:/usr/share/elasticsearch/data
mylogstash:
build:
context: .
dockerfile: Dockerfile
volumes:
- ./config-dir:/mylogstash/config-dir:rw
- ./data:/mylogstash/data:rw
ports:
- "5000:5000"
- "5001:5001"
- "514:514"
tty: true
command: ["bash"]
links:
- elasticsearch
kibana:
image: kibana
ports:
- "5601:5601"
links:
- elasticsearch
```
And start correctly as expected:
```
# docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------------------------
logstash_elasticsearch_ /docker-entrypoint.sh Up 0.0.0.0:9200->9200/tcp,
1 elas ... 0.0.0.0:9300->9300/tcp
logstash_kibana_1 /docker-entrypoint.sh Up 0.0.0.0:5601->5601/tcp
kibana
logstash_mylogstash_1 /docker-entrypoint.sh Up 0.0.0.0:5000->5000/tcp,
bash 0.0.0.0:5001->5001/tcp,
0.0.0.0:514->514/tcp
```
---
### Author:  [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)
#### Post date: [May 7, 2018, 11:07pm UTC](https://discuss.elastic.co/t/cannot-make-logstash-read-syslog/130687/8 "2018-05-07T23:07:35Z")
Tested with installed version and it works.
Either something wrong with my ELK docker-compsoe config. or with logstash container 🤔
Are ELK containers production ready?
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [May 8, 2018, 5:33am UTC](https://discuss.elastic.co/t/cannot-make-logstash-read-syslog/130687/9 "2018-05-08T05:33:49Z")
Notice in the output of `docker-compose ps` you see only TCP ports lists. No UDP. In your docker-compose file you should try:
```auto
ports:
- "5000/tcp:5000/tcp"
- "5001/udp:5001/udp"
- "514/udp:514/udp"
- "514/tcp:514/tcp"
```
Adjust for whatever ports you end up using.
This is explained here... [https://github.com/moby/moby/issues/32958](https://github.com/moby/moby/issues/32958)
---
### Author:  [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)
#### Post date: [May 9, 2018, 3:03am UTC](https://discuss.elastic.co/t/cannot-make-logstash-read-syslog/130687/10 "2018-05-09T03:03:15Z")
Thanks for the hint @rcowart .
Indeed it was only listening to tcp.
And it accepts the below foramt:
```
ports:
- "5000:5000/tcp"
```
Otherwise it throws an error:
> services.mylogstash.ports is invalid: Invalid port "5000/tcp:5000/tcp", should be [[remote\_ip:]remote\_port[-remote\_port]:]port[/protocol]
* * *
Now it also listens to udp:
```
$ docker-compose ps
Name Command State Ports
------------------------------------------------------------------------------------------------------------
elksyslog_elasticsearch_1 /docker-entrypoint.sh elas ... Up 0.0.0.0:9200->9200/tcp,
0.0.0.0:9300->9300/tcp
elksyslog_kibana_1 /docker-entrypoint.sh kibana Up 0.0.0.0:5601->5601/tcp
elksyslog_mylogstash_1 /docker-entrypoint.sh bash Up 0.0.0.0:5000->5000/tcp,
0.0.0.0:5001->5001/udp,
0.0.0.0:514->514/udp,
0.0.0.0:8080->8080/tcp
```
Now it works fine!!
Thanks alot @rcowart
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2018, 3:03am UTC](https://discuss.elastic.co/t/cannot-make-logstash-read-syslog/130687/11 "2018-06-06T03:03:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.