# How to run Logstash multiple instance

**URL:** https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959
**Category:** Logstash
**Created:** [April 11, 2016, 8:26am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959 "2016-04-11T08:26:33Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [April 11, 2016, 8:26am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/1 "2016-04-11T08:26:33Z")

</div>

hello,

in trying to run second logstash instance with a different config file (for syslog events) i'm getting this error:

"Pipeline aborted due to error {:exception=\>#\<Errno::EACCES: Permission denied - bind(2)"

how can i change the port so i want clash?

thanks,  
guy

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 11, 2016, 8:28am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/2 "2016-04-11T08:28:04Z")

</div>

How are you running each one?

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [April 11, 2016, 8:31am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/3 "2016-04-11T08:31:11Z")

</div>

one runs as a service and the other manually (for testing). it dose not work if it put the conf file in the conf.d folder also.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 11, 2016, 8:34am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/4 "2016-04-11T08:34:41Z")

</div>

You need to pass the `-f` flag, see [https://www.elastic.co/guide/en/logstash/current/command-line-flags.html](https://www.elastic.co/guide/en/logstash/current/command-line-flags.html)

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [April 11, 2016, 8:38am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/5 "2016-04-11T08:38:23Z")

</div>

i did. but i'm getting this:  
Pipeline aborted due to error Errno::EACCES: Permission denied - bind(2)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 11, 2016, 8:39am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/6 "2016-04-11T08:39:27Z")

</div>

Maybe if you provide your config we can help.

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [April 11, 2016, 8:44am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/7 "2016-04-11T08:44:02Z")

</div>

input {  
tcp {  
port =\> 514  
type =\> syslog  
}  
udp {  
port =\> 514  
type =\> syslog  
}  
}

filter {  
date {  
match =\> ["ts", "UNIX"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "logstash-bro-%{+YYYY.MM.dd}"  
}  
}

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 11, 2016, 9:17am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/8 "2016-04-11T09:17:22Z")

</div>

When you run LS manually are you doing it as root? If not, that's why.

---

<div class="post-metadata">

### Author: ![ggilat](https://avatars.discourse-cdn.com/v4/letter/g/c67d28/32.png) [@ggilat](https://discuss.elastic.co/u/ggilat)
#### Post date: [April 11, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/9 "2016-04-11T09:23:01Z")

</div>

Working!

thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959/10 "2017-07-06T05:02:56Z")

</div>