# Custom UDP logs are only listening on ipv6 **URL:** \ **Category:** Elastic Agent\ **Created:** [January 6, 2024, 12:12am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497 "2024-01-06T00:12:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![phirestalker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phirestalker/32/94221_2.png) [@phirestalker](https://discuss.elastic.co/u/phirestalker)\ **Post date:** [January 6, 2024, 12:12am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/1 "2024-01-06T00:12:42Z")
I set up some custom UDP port integrations. I noticed that a lot of logs were not coming in, so I did netstat on the host. It turns out that it is only listening on ipv6. How can I set it to listen on both or only ipv4? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 6, 2024, 12:44am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/2 "2024-01-06T00:44:19Z")
Hi @phirestalker Welcome to the community! You are going to need to provide your integration configuration settings if you would like help. ---
**Author:** ![phirestalker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phirestalker/32/94221_2.png) [@phirestalker](https://discuss.elastic.co/u/phirestalker)\ **Post date:** [January 6, 2024, 12:37pm UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/3 "2024-01-06T12:37:24Z")
Thanks I wasn't sure what to post. Also, I am using version 8.11.3 of the stack, and I am setting up Fleet managed elastic-agents. I figured the easiest way to show integration configuration for the custom UDP logs was to copy the API call. I have pasted below. ```auto PUT kbn:/api/fleet/package_policies/0f0c6b07-43a7-4d3f-b088-e13ca785b891 { "package": { "name": "udp", "version": "1.17.0" }, "name": "udp-5141", "namespace": "default", "description": "Syslog from WAX610 wireless AP", "policy_id": "60ae7570-ac19-11ee-9483-459dcdc18bc9", "vars": {}, "inputs": { "udp-udp": { "enabled": true, "streams": { "udp.generic": { "enabled": true, "vars": { "listen_address": "0.0.0.0", "listen_port": "5141", "data_stream.dataset": "udp.wax510", "max_message_size": "10KiB", "keep_null": false, "tags": [ "wap, wireless, netgear" ], "syslog": true, "syslog_options": "field: message\n#format: auto\n#timezone: Local\n", "custom": "" } } } } } } ``` Oh, and the agent is on Ubuntu 22.04 ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 6, 2024, 12:40pm UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/4 "2024-01-06T12:40:17Z")
Can you share as well any evidence that it is only listening on ipv6? For example, share the result of your netstat on port 5141. ---
**Author:** ![phirestalker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phirestalker/32/94221_2.png) [@phirestalker](https://discuss.elastic.co/u/phirestalker)\ **Post date:** [January 6, 2024, 12:42pm UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/5 "2024-01-06T12:42:03Z")
```auto sudo netstat -anp | grep 5141 udp6 0 0 :::5141 :::* 97402/filebeat unix 3 [] STREAM CONNECTED 45851414 2654/dockerd /run/docker.sock ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 6, 2024, 1:00pm UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/6 "2024-01-06T13:00:44Z")
Yeah, it is weird, if you are specifying the bind address as `0.0.0.0` I see no reason for it to even bind on ipv6. It looks like something on the OS is defaulting to bind to ipv6, I had similar issues with Logstash and Elastcisearch in the past, but those are java applications so you can force them to use ipv4. Not sure how to do this on a Go application like beats, maybe someone from Elastic has more context. I think that you could also open an issue on github to get more attention on this, because the bind address is being ignored and it shouldn't be ignored. ---
**Author:** ![phirestalker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phirestalker/32/94221_2.png) [@phirestalker](https://discuss.elastic.co/u/phirestalker)\ **Post date:** [January 6, 2024, 1:15pm UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/7 "2024-01-06T13:15:54Z")
I guess I will have to. I just disabled ipv6 on my machine by adding a custom config file under /etc/sysctl.d with the following contents: ```auto net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 ``` I rebooted, and it is still opening an ipv6 UDP port. I took the nuclear option and just disabled ipv6 in my grub configuration. Now it is using ipv4 ports as it should. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 7, 2024, 7:06am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/8 "2024-01-07T07:06:00Z")
It should be related to Linux settings. Check the [link](https://weblog.lkiesow.de/20220311-make-linux-prefer-ipv4.html). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 4, 2024, 7:06am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497/9 "2024-02-04T07:06:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.