How to run Logstash multiple instance

Elastic Stack Logstash
1

hello,

in trying to run second logstash instance with a different config file (for syslog events) i'm getting this error:

"Pipeline aborted due to error {:exception=>#<Errno::EACCES: Permission denied - bind(2)"

how can i change the port so i want clash?

thanks,
guy

2

How are you running each one?

3

one runs as a service and the other manually (for testing). it dose not work if it put the conf file in the conf.d folder also.

4

You need to pass the -f flag, see https://www.elastic.co/guide/en/logstash/current/command-line-flags.html

5

i did. but i'm getting this:
Pipeline aborted due to error Errno::EACCES: Permission denied - bind(2)

6

Maybe if you provide your config we can help.

7

input {
tcp {
port => 514
type => syslog
}
udp {
port => 514
type => syslog
}
}

filter {
date {
match => [ "ts", "UNIX" ]
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-bro-%{+YYYY.MM.dd}"
}
}

8

When you run LS manually are you doing it as root? If not, that's why.

9

Working!

thanks