# How to config logstash to listen privilage port without root access

**URL:** https://discuss.elastic.co/t/how-to-config-logstash-to-listen-privilage-port-without-root-access/67080
**Category:** Logstash
**Created:** [November 24, 2016, 9:27am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-listen-privilage-port-without-root-access/67080 "2016-11-24T09:27:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bopa](https://avatars.discourse-cdn.com/v4/letter/b/a6a055/32.png) [@bopa](https://discuss.elastic.co/u/bopa)
#### Post date: [November 24, 2016, 9:27am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-listen-privilage-port-without-root-access/67080/1 "2016-11-24T09:27:53Z")

</div>

I want to collect syslogs from cisco switch which will use UDP 514 to send syslogs.  
I tried setcap command and port forwarding on firewall. But failed. I used following commands,

setcap -

setcap cap\_net\_bind\_service=+epi /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.el7\_2.x86\_64/jre/bin/java  
setcap cap\_net\_bind\_service=+epi /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.111-2.6.7.2.el7\_2.x86\_64/jre/bin/java

Firewall commands -  
firewall-cmd --permanent --add-forward-port=port=514:proto=tcp:toport=5514  
firewall-cmd --permanent --add-forward-port=port=514:proto=udp:toport=5514

what did I do wrong? is their any other way to achieve the same goal. Please help.

My Logstash conf file-

input {  
beats {  
port =\> 5000  
type =\> "filebeat"  
}  
beats {  
port =\> 5001  
type =\> "winlogbeat"  
}  
syslog {  
port =\> 514  
type =\> "syslog"  
}  
}

# Filebeat filter

filter {  
#ignore log comments  
if [message] =~ "^#" {  
drop {}  
}  
grok {  
#patterns\_dir =\> "./patterns"

match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{IPORHOST:servername1} %{IPORHOST:serverip} %{WORD:verb} %{NOTSPACE:request1} %{GREEDYDATA:request2} %{NUMBER:port} %{IPORHOST:clientip} %{NOTSPACE:protocol} %{NOTSPACE:querystring} %{IPORHOST:servername} %{NOTSPACE:agent} %{NOTSPACE:referrer} %{NUMBER:response} %{NUMBER:sub\_response} %{NUMBER:sc\_status} %{NUMBER:responsetime}"}  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
locale =\> "en"  
}  
}

# Second filter

#filter {

# if "\_grokparsefailure" in [tags] {

# } else {

# # on success remove the message field to save space

# mutate {

```
# remove_field => ["message", "timestamp", "servername", "servername1"]
#}

```

# }

#}

output {  
elasticsearch {  
hosts =\> ["172.........:9200"]  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

### Author: ![bopa](https://avatars.discourse-cdn.com/v4/letter/b/a6a055/32.png) [@bopa](https://discuss.elastic.co/u/bopa)
#### Post date: [November 28, 2016, 8:14am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-listen-privilage-port-without-root-access/67080/2 "2016-11-28T08:14:46Z")

</div>

Any one any ideas???

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 26, 2016, 8:15am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-listen-privilage-port-without-root-access/67080/3 "2016-12-26T08:15:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.