# Help this case with logstash.conf

**URL:** <https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677>\
**Category:** Logstash\
**Created:** [August 10, 2016, 9:36am UTC](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677 "2016-08-10T09:36:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Inbeo\_Beo](https://avatars.discourse-cdn.com/v4/letter/i/d78d45/32.png) [@Inbeo\_Beo](https://discuss.elastic.co/u/Inbeo_Beo)\
**Post date:** [August 10, 2016, 9:36am UTC](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677/1 "2016-08-10T09:36:40Z")

</div>

dear

i have 01 logstash config file with code below  
input {  
tcp {  
host =\> "10.151.130.121"  
port =\> "514"  
type =\> "rsyslog"  
}  
udp {  
host =\> "10.151.130.121"  
port =\> "514"  
type =\> "rsyslog"  
}  
}

filter {  
if [type] == "rsyslog" {  
grok {  
match =\> { "message" =\> "%{RSYSLOGTIMESTAMP:rsyslog\_timestamp} %{RSYSLOGHOST:rsyslog\_hostname} %{DATA:rsyslog\_program}(?:[%{POSINT:rsyslog\_pid}])?: %{GREEDYDATA:rsyslog\_message}" }

```
  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]
  }

 date {
  match => ["rsyslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}

```

}  
}

output {  
elasticsearch {  
hosts =\> ["10.151.130.114:9200"]  
}  
stdout { codec =\> rubydebug }

And after i run  
bin/logstash agent -f /etc/logstash/conf.d/logstash.conf

i have a report about error with my file

Pipeline aborted due to error {:exception=\>#\<Errno::EADDRNOTAVAIL: Cannot assign requested address - bind - Cannot assign requested address\>, :backtrace=\>["org/jruby/ext/socket/RubyTCPServer.java:118:in `initialize'", "org/jruby/RubyIO.java:853:in`new'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:244:in `new_server_socket'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:79:in`register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:330:in `start_inputs'", "org/jruby/RubyArray.java:1613:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:329:in `start_inputs'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:180:in`start\_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/agent.rb:465:in`start\_pipeline'"], :level=\>:error}  
stopping pipeline {:id=\>"main"}

I don't understand about this error, please help me resolve it  
Regds

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2016, 9:46am UTC](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677/2 "2016-08-10T09:46:03Z")

</div>

Which user is Logstash running as? Only root can bind to sockets \< 1024 (but there are workarounds; google it). The problem could also be that there already is something listening on that port.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677/3 "2017-07-06T04:44:05Z")

</div>

Closed on July 6, 2017, 4:44am UTC