How to run Logstash multiple instance

Elastic Stack Logstash
#1

hello,

in trying to run second logstash instance with a different config file (for syslog events) i'm getting this error:

"Pipeline aborted due to error {:exception=>#<Errno::EACCES: Permission denied - bind(2)"

how can i change the port so i want clash?

thanks,
guy

#2

How are you running each one?

#3

one runs as a service and the other manually (for testing). it dose not work if it put the conf file in the conf.d folder also.

#4

You need to pass the -f flag, see https://www.elastic.co/guide/en/logstash/current/command-line-flags.html

#5

i did. but i'm getting this:
Pipeline aborted due to error Errno::EACCES: Permission denied - bind(2)

#6

Maybe if you provide your config we can help.

#7

input {
tcp {
port => 514
type => syslog
}
udp {
port => 514
type => syslog
}
}

filter {
date {
match => [ "ts", "UNIX" ]
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-bro-%{+YYYY.MM.dd}"
}
}

#8

When you run LS manually are you doing it as root? If not, that's why.

#9

Working!

thanks

#10