# Can't not bind listen port 5140 to logstash ubuntu 18.04 **URL:** \ **Category:** Logstash\ **Created:** [October 5, 2019, 3:32pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428 "2019-10-05T15:32:06Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 5, 2019, 3:32pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/1 "2019-10-05T15:32:06Z")
Nothing is using that port, guyp@ubuntu:/etc/logstash/conf.d$ netstat -an | grep 5140 tcp 0 0 127.0.0.1:9200 127.0.0.1:51406 ESTABLISHED tcp 0 0 127.0.0.1:9200 127.0.0.1:51400 ESTABLISHED tcp 0 0 127.0.0.1:51400 127.0.0.1:9200 ESTABLISHED tcp 0 0 127.0.0.1:51408 127.0.0.1:9200 ESTABLISHED tcp 0 0 127.0.0.1:9200 127.0.0.1:51408 ESTABLISHED tcp 0 0 127.0.0.1:51406 127.0.0.1:9200 ESTABLISHED guyp@ubuntu:/etc/logstash/conf.d$ grep udp /etc/logstash/conf.d/\* /etc/logstash/conf.d/01-inputs.conf: udp { grep: /etc/logstash/conf.d/patterns: Is a directory java version "12.0.2" 2019-07-16 Java(TM) SE Runtime Environment (build 12.0.2+10) Java HotSpot(TM) 64-Bit Server VM (build 12.0.2+10, mixed mode, sharing) curl: (7) Failed to connect to localhost port 9600: Connection refused guyp@ubuntu:/etc/logstash/conf.d$ curl [http://localhost:9200](http://localhost:9200) { "name" : "ubuntu", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "L4moMAVoRE-Vqi4NDBUOtw", "version" : { "number" : "7.4.0", "build\_flavor" : "default", "build\_type" : "deb", "build\_hash" : "22e1767283e61a198cb4db791ea66e3f11ab9910", "build\_date" : "2019-09-27T08:36:48.569419Z", "build\_snapshot" : false, "lucene\_version" : "8.2.0", "minimum\_wire\_compatibility\_version" : "6.8.0", "minimum\_index\_compatibility\_version" : "6.0.0-beta1" }, "tagline" : "You Know, for Search" I have uninstalled/re-installed logstash and java w/ out success and at a loss. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 5, 2019, 3:42pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/2 "2019-10-05T15:42:56Z")
What is the complete configuration of the udp input and what error message do you get? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 5, 2019, 4:22pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/4 "2019-10-05T16:22:30Z")
What error message do you get? ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 5, 2019, 4:29pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/5 "2019-10-05T16:29:09Z")
I assume because port 5140 is not open/listening.... | Oct 5 11:27:38 | kernel: arp: 192.168.1.116 moved from 74:d6:37:6c:7f:62 to 7c:61:66:14:cd:4e on xn1 | | --- | --- | | Oct 5 11:27:35 | syslog-ng[21178]: Syslog connection broken; fd='25', server='AF\_INET(192.168.1.130:5140)', time\_reopen='60' | | Oct 5 11:27:35 | syslog-ng[21178]: I/O error occurred while writing; fd='25', error='Connection refused (61)' | | Oct 5 11:27:35 | syslog-ng[21178]: Syslog connection established; fd='25', server='AF\_INET(192.168.1.130:5140)', local='AF\_INET(192.168.1.1:0)' | ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 5, 2019, 5:26pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/6 "2019-10-05T17:26:35Z")
What is in the logstash logs? ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 5, 2019, 5:31pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/7 "2019-10-05T17:31:41Z")
[2019-10-05T12:30:40,460][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-05T12:30:45,509][INFO][logstash.runner] Logstash shut down. [2019-10-05T12:30:58,925][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.4.0"} [2019-10-05T12:30:59,919][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, input, filter, output at line 36, column 1 (byte 546) after ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in`block in converge\_state'"]} [2019-10-05T12:31:00,125][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-05T12:31:05,185][INFO][logstash.runner] Logstash shut down. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 5, 2019, 6:10pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/8 "2019-10-05T18:10:55Z")
It looks like you have an error in one of your other config files which prevents Logstash from starting. ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 5, 2019, 6:22pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/9 "2019-10-05T18:22:24Z")
Yea, I have checked both 01 and 05 in /etc/logstash/conf.d, but cant determine the issue.... ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 5, 2019, 6:32pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/10 "2019-10-05T18:32:14Z")
If you show all your config we may be able to help. ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 5, 2019, 6:45pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/12 "2019-10-05T18:45:31Z")
``` # PF Firewall Logs input { tcp { port => 5140 type => "syslog" } udp { port => 5140 type => "syslog" } } ``` * * * ``` # 05-syslog.conf filter { if [type] == "syslog" { #Adjust to match the IP address of pfSense or OPNSense if [host] =~ /192\.168\.1\.1/ { mutate { add_tag => ["pf", "Ready"] } } if [host] =~ /172\.2\.22\.1/ { mutate { add_tag => ["pf-2", "Ready"] } } if "Ready" not in [tags] { mutate { add_tag => ["syslog"] } } } } filter { if [type] == "syslog" { mutate { remove_tag => "Ready" } } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 5, 2019, 8:13pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/13 "2019-10-05T20:13:00Z")
Is OPNsense on a separate line compared to the rest of the comment? ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 6, 2019, 1:29am UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/14 "2019-10-06T01:29:44Z")
No, it's on the same line. "ConfigurationError", :message=\>"Expected one of #, =\> at line 25, column" where/what config file is the above error referring to? [2019-10-05T22:14:21,721][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-05T22:14:26,782][INFO][logstash.runner] Logstash shut down. [2019-10-05T22:14:43,882][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.4.0"} [2019-10-05T22:14:45,298][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 25, column 6 (byte 410) after filter {\n if [type] == "syslog" {\n #Adjust to match the IP address of pfSense or OPNSense\n if [host] =~ /192\.168\.1\.1/ {\n mutate {\n add\_tag =\> ["pf", "Ready"]\n }\n if "Ready" not in [tags] {\n mutate {\n add\_tag =\> ["syslog"]\n }\n }\n }\n}\nfilter {\n if ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in`block in converge\_state'"]} [2019-10-05T22:14:45,540][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-05T22:14:50,611][INFO][logstash.runner] Logstash shut down. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 6, 2019, 1:47pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/15 "2019-10-06T13:47:58Z")
The log messages do not match the configuration you are showing us (the log does not include /172.2.22.1/). What configuration produced that log message? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 6, 2019, 2:07pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/17 "2019-10-06T14:07:04Z")
You cannot nest a filter group inside a filter group. ``` filter { if [type] == "syslog" { #Adjust to match the IP address of pfSense or OPNSense if [host] =~ /192.168.1.1/ { mutate { add_tag => ["pf", "Ready"] } if "Ready" not in [tags] { mutate { add_tag => ["syslog"] } } } } filter { if [type] == "syslog" { mutate { remove_tag => "Ready" } } } ``` ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 6, 2019, 2:17pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/18 "2019-10-06T14:17:09Z")
So I would assume I need to remove the following from the above config? filter { if [type] == "syslog" { mutate { remove\_tag =\> "Ready" } } } Thanks ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 6, 2019, 2:20pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/19 "2019-10-06T14:20:15Z")
You can leave the logic just remove that `filter` block / braces as you can not nest them as @Badger indicated but you can leave that if block / logic if you need to. ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 6, 2019, 2:26pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/20 "2019-10-06T14:26:27Z")
I am new to this so I appreciate the feedback/help, so is this correct: ``` # 05-syslog.conf filter if [type] == "syslog" { #Adjust to match the IP address of pfSense or OPNSense if [host] =~ /192\.168\.1\.1/ { mutate { add_tag => ["pf", "Ready"] } if "Ready" not in [tags] { mutate { add_tag => ["syslog"] } } } } if [type] == "syslog" { mutate { remove_tag => "Ready" } } } ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 6, 2019, 2:30pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/21 "2019-10-06T14:30:13Z")
It would really help if you formatted your code using the code formatter '\' button on the post editor ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 6, 2019, 2:30pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/22 "2019-10-06T14:30:28Z")
Made the change and restarted logstash w/ same results: guyp@ubuntu:/var/log/logstash$ tail logstash-plain.log [2019-10-06T09:28:09,088][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-06T09:28:13,960][INFO][logstash.runner] Logstash shut down. [2019-10-06T09:28:36,466][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.4.0"} [2019-10-06T09:28:38,178][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 35, column 28 (byte 628) after filter {\n if "pf" in [tags] {\n grok {\n match =\> ["message" ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in`block in converge\_state'"]} [2019-10-06T09:28:38,466][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-06T09:28:43,364][INFO][logstash.runner] Logstash shut down. [2019-10-06T09:29:04,802][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.4.0"} [2019-10-06T09:29:06,587][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 35, column 28 (byte 628) after filter {\n if "pf" in [tags] {\n grok {\n match =\> ["message" ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in`block in converge\_state'"]} [2019-10-06T09:29:06,886][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-10-06T09:29:11,954][INFO][logstash.runner] Logstash shut down. ---
**Author:** ![Bubba\_Shakes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bubba_shakes/32/55276_2.png) [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Post date:** [October 6, 2019, 2:44pm UTC](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428/23 "2019-10-06T14:44:25Z")
``` 05-syslog.conf filter { if [type] == "syslog" { #Adjust to match the IP address of pfSense or OPNSense if [host] =~ /192\.168\.1\.1/ { mutate { add_tag => ["pf", "Ready"] } if "Ready" not in [tags] { mutate { add_tag => ["syslog"] } } } } if [type] == "syslog" { mutate { remove_tag => "Ready" } } } ``` [Next page](https://discuss.elastic.co/t/cant-not-bind-listen-port-5140-to-logstash-ubuntu-18-04/202428.md?page=2)