# I want to Install Logstash in EC2 Linux UBUNTU 22.04 and want to run Syslog input Configuration but facing ERROR

**URL:** <https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571>\
**Category:** Logstash\
**Created:** [January 8, 2024, 11:17am UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571 "2024-01-08T11:17:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\
**Post date:** [January 8, 2024, 11:17am UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571/1 "2024-01-08T11:17:34Z")

</div>

I Followed this URL:

[Installing Logstash | Logstash Reference [7.14] | Elastic](https://www.elastic.co/guide/en/logstash/7.14/installing-logstash.html)

APT one I followed.

Then after the Installation I set the path of bin in Environment variable using below command.

```auto
1- Location of logstash in UBUNTU:

	cd /usr/share/logstash -- here you can see logstash file.

2- Set Bin path to enviroment:

	echo 'export PATH=$PATH:/usr/share/logstash/bin' >> ~/.bashrc
	
	source ~/.bashrc

```

Then I created a Conf. file inside bin and then run `logstash -f <filename>.conf --config.test_and_exit` that Conf. file It is giving below error:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/3/c3258ea11ca77e48fa3ea697d59d96913930d436.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 8, 2024, 12:42pm UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571/2 "2024-01-08T12:42:13Z")

</div>

You need to run logstash as the **logstash** user and you also need to use the `path.settings` parameter to tell the binary where the settings file are.

Try the following:

```auto
sudo -u logstash /usr/share/logstash/bin/logstash -f /path/to/your.conf --path.settings="/etc/logstash" --config.test_and_exit

```

---

<div class="post-metadata">

**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\
**Post date:** [January 9, 2024, 5:58am UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571/3 "2024-01-09T05:58:05Z")

</div>

I successfully able to do setup when I am running my configuration using SYSLOG input plugin it is giving below error:

```auto
[2024-01-09T05:57:29,726][WARN][logstash.inputs.syslog][main][23661f886619ae58c9e40cd1e34ee10ecb939617186e5d173e5b3f2a673089a0] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:210:in `bind'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:191:in `udp_listener'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:152:in `block in run'"]}
[2024-01-09T05:57:34,682][INFO][logstash.inputs.syslog][main][23661f886619ae58c9e40cd1e34ee10ecb939617186e5d173e5b3f2a673089a0] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2024-01-09T05:57:34,686][WARN][logstash.inputs.syslog][main][23661f886619ae58c9e40cd1e34ee10ecb939617186e5d173e5b3f2a673089a0] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:129:in `initialize'", "org/jruby/RubyIO.java:876:in `new'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:208:in `tcp_listener'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:156:in `block in run'"]}
[2024-01-09T05:57:34,726][INFO][logstash.inputs.syslog][main][23661f886619ae58c9e40cd1e34ee10ecb939617186e5d173e5b3f2a673089a0] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2024-01-09T05:57:34,727][WARN][logstash.inputs.syslog][main][23661f886619ae58c9e40cd1e34ee10ecb939617186e5d173e5b3f2a673089a0] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:210:in `bind'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:191:in `udp_listener'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/home/ubuntu/logstash-7.14/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:152:in `block in run'"]}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 9, 2024, 12:41pm UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571/4 "2024-01-09T12:41:04Z")

</div>

You need to change the port, ports below `1024` are reserved for the _root_ user and Logstash does not run as _root_.

Choose a higher port number like `5514`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2024, 12:41pm UTC](https://discuss.elastic.co/t/i-want-to-install-logstash-in-ec2-linux-ubuntu-22-04-and-want-to-run-syslog-input-configuration-but-facing-error/350571/5 "2024-02-06T12:41:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.