I am setting up an EFK cluster and filebeats are not being received I believe the error is due to the following EADDRINUSE error="Address already in use - bind(2) for "0.0.0.0" port 5044"
when elasticserch and td-agent are stopped I dont see anything listening on port 5044
When running netstat -tupln | grep 5044 I see the following
tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN 17991/ruby
I have taken out everything in the conf file for port 5044 but I still see the error.
What is binding to port 5044?