Filebeat UDP listener is configured but not receiving expected data, even though Wireshark shows logs being transmitted

Hi Team

I have really weird issue.

I have Filebeat configured to except logs on port 514, here is the input configurations:


-type: udp
enabled: true
max_message_size: 64KiB
host: ""

Here are the logs from the Filebeat service logs:

As you can see the UDP listener is started, but no logs are being processed by the pipeline. There are no errors or warnings in the logs, even at the debug level.

We see that the Filebeat is listening on port 514

C:\Users\filebeatadmin>netstat -ano | findstr 514
UDP : 1484
UDP [::]:514 : 1484

  • We clearly see on Wireshark on this host that logs being sent to this port 514 continuously.
  • We installed Kiwi server instead that also listen to logs on UDP and we do see that logs are being indexed.
  • When we configured the Kiwi service to except the logs on port and send it to the Filebeat service to port, and configured input on the Filebeat on port the Filebeat is accepting logs as expected.

This is really weird issue any help will be much appreciated!
Thanks in advanced