# Help receiving syslog data in Logstash **URL:** \ **Category:** Elasticsearch\ **Created:** [November 12, 2014, 3:14pm UTC](https://discuss.elastic.co/t/help-receiving-syslog-data-in-logstash/20709 "2014-11-12T15:14:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Andrew\_Stacey](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@Andrew\_Stacey](https://discuss.elastic.co/u/Andrew_Stacey)\ **Post date:** [November 12, 2014, 3:14pm UTC](https://discuss.elastic.co/t/help-receiving-syslog-data-in-logstash/20709/1 "2014-11-12T15:14:34Z")
This is probably a very noobish question. I just starting playing with an ELK stack I have set up on Centos 7. All the core services seem to be working but I can't seem to get it to receive syslog messages. I have both selinux and the firewall turned off (just a local lab right now). Netstat -nlp does not show anything listening on port 514. According to the logstash book, I need to add the following syslog input plugin syslog { type =\> syslog port =\> 5514 } in /etc/logstash/conf.d/central.conf but that file does not exist on my machine. The only files in that directory are named 01-lumberjack-input.conf. 10-syslog.conf, and 30-lumberjack-output.conf. Looking inside those three, it does not look like putting anything there will help, though I did try adding the above code in the 01-lumberjack-input.conf to no affect. Before I wasted a ton of time overlooking something simple, does anyone who has set up logstash see what piece I am missing to enable to receipt of syslog entries? I have two device trying to send the data, one a sonicwall firewall, the other is just a windows machine using nxlog. The nxlog.log file throws the following error: ERROR couldn't connect to tcp socket on 10.1.10.154:514; No connection could be made because the target machine actively refused it. So I am sure I am at least sending some data to Logstash. I'm sure it is something simple I missed but for the life of me just can't see it. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3950e372-0cee-42c4-b429-9b443b119820%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3950e372-0cee-42c4-b429-9b443b119820%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 12, 2014, 3:54pm UTC](https://discuss.elastic.co/t/help-receiving-syslog-data-in-logstash/20709/2 "2014-11-12T15:54:05Z")
On Wednesday, November 12, 2014 at 16:14 CET, Andrew Stacey [arstacey@gmail.com](mailto:arstacey@gmail.com) wrote: > This is probably a very noobish question. I just starting playing > with an ELK stack I have set up on Centos 7. All the core services > seem to be working but I can't seem to get it to receive syslog > messages. I have both selinux and the firewall turned off (just a > local lab right now). Netstat -nlp does not show anything listening > on port 514. > > According to the logstash book, I need to add the following syslog > input plugin > > syslog { > type =\> syslog > port =\> 5514 > } This question would've been a better fit for the Logstash mailing list. [https://groups.google.com/forum/#!forum/logstash-users](https://groups.google.com/forum/#!forum/logstash-users) [...] > ERROR couldn't connect to tcp socket on 10.1.10.154:514; No connection > could be made because the target machine actively refused it. nxlog tries to send to port 514 but you've configured Logstash to listen on port 5514. Either one needs to be adjusted to match the other. Keep in mind that only root can listen on port 514 (but see below) and Logstash is typically not run as root. > [...] -- Magnus Bäck | Software Engineer, Development Tools [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20141112155404.GA25446%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20141112155404.GA25446%40seldlx20533.corpusers.net). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Andrew\_Stacey](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@Andrew\_Stacey](https://discuss.elastic.co/u/Andrew_Stacey)\ **Post date:** [November 12, 2014, 4:01pm UTC](https://discuss.elastic.co/t/help-receiving-syslog-data-in-logstash/20709/3 "2014-11-12T16:01:59Z")
Crap... I'm sorry. Noobish indeed. Didn't even realized there was a separate group. I'll post it over there. Thanks! On Wednesday, November 12, 2014 9:14:34 AM UTC-6, Andrew Stacey wrote: > This is probably a very noobish question. I just starting playing with an > ELK stack I have set up on Centos 7. All the core services seem to be > working but I can't seem to get it to receive syslog messages. I have both > selinux and the firewall turned off (just a local lab right now). Netstat > -nlp does not show anything listening on port 514. > > According to the logstash book, I need to add the following syslog input > plugin > > syslog { > type =\> syslog > port =\> 5514 > } > > in /etc/logstash/conf.d/central.conf but that file does not exist on my > machine. The only files in that directory are named > 01-lumberjack-input.conf. 10-syslog.conf, and 30-lumberjack-output.conf. > Looking inside those three, it does not look like putting anything there > will help, though I did try adding the above code in the > 01-lumberjack-input.conf to no affect. > > Before I wasted a ton of time overlooking something simple, does anyone > who has set up logstash see what piece I am missing to enable to receipt of > syslog entries? I have two device trying to send the data, one a sonicwall > firewall, the other is just a windows machine using nxlog. The nxlog.log > file throws the following error: > > ERROR couldn't connect to tcp socket on 10.1.10.154:514; No connection > could be made because the target machine actively refused it. > > So I am sure I am at least sending some data to Logstash. I'm sure it is > something simple I missed but for the life of me just can't see it. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/5cc9750e-11ac-4c76-ad31-eeda43e5cd38%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/5cc9750e-11ac-4c76-ad31-eeda43e5cd38%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:50am UTC](https://discuss.elastic.co/t/help-receiving-syslog-data-in-logstash/20709/4 "2017-07-06T00:50:28Z")