How to run Logstash multiple instance


in trying to run second logstash instance with a different config file (for syslog events) i'm getting this error:

"Pipeline aborted due to error {:exception=>#<Errno::EACCES: Permission denied - bind(2)"

how can i change the port so i want clash?


How are you running each one?

one runs as a service and the other manually (for testing). it dose not work if it put the conf file in the conf.d folder also.

You need to pass the -f flag, see

i did. but i'm getting this:
Pipeline aborted due to error Errno::EACCES: Permission denied - bind(2)

Maybe if you provide your config we can help.

input {
tcp {
port => 514
type => syslog
udp {
port => 514
type => syslog

filter {
date {
match => [ "ts", "UNIX" ]

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-bro-%{+YYYY.MM.dd}"

When you run LS manually are you doing it as root? If not, that's why.