# Is logstash taking packets?

**URL:** <https://discuss.elastic.co/t/is-logstash-taking-packets/130955>\
**Category:** Logstash\
**Created:** [May 8, 2018, 8:32am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955 "2018-05-08T08:32:05Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 8:32am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/1 "2018-05-08T08:32:05Z")

</div>

Hi, is there any way I can look if my **logstash** is taking the pakets that arrives at port 5000?

Thanks MrNerd

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 8, 2018, 8:41am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/2 "2018-05-08T08:41:14Z")

</div>

Add an output, e.g. `stdout { codec => rubydebug }` that just dumps the raw events.

---

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 9:07am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/3 "2018-05-08T09:07:21Z")

</div>

**Input** configuration:

> input {  
> tcp {  
> host =\> "192.168.128.51"  
> port =\> 5000  
> id =\> "input-1"  
> }  
> }  
> input {  
> udp {  
> host =\> "192.168.128.51"  
> port =\> 5000  
> id =\> "input-2"  
> }  
> }

And here the **output** configuration:  
output {  
stdout { codec =\> rubydebug }  
}

`the path where everithing this is configured is: "/etc/logstash/conf.d/input.conf"`

(Is the same file for input and output), i mean `output and input` are in **input.conf** both

Packets are arriving at port 5000.

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/992122deee39300a245c3be906050bf6d946e160.png)

---

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 9:12am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/4 "2018-05-08T09:12:48Z")

</div>

@magnusbaeck thanks for everything

> [2018-05-08T11:10:54,820][INFO][logstash.inputs.udp] UDP listener started {:address=\>"192.168.128.51:5000", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 8, 2018, 10:12am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/5 "2018-05-08T10:12:11Z")

</div>

How are you starting Logstash? Is 192.168.128.51 the eth0 interface?

---

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 11:37am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/6 "2018-05-08T11:37:53Z")

</div>

yeah why are u asking that?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 8, 2018, 11:53am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/7 "2018-05-08T11:53:47Z")

</div>

Because that's where tcpdump is listening. Please answer my other question.

---

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 11:57am UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/8 "2018-05-08T11:57:06Z")

</div>

I just use `service logstash restart` and `systemctl restart logstash.service` both if i make any change 😛

Thanks 4 everything btw

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 8, 2018, 12:05pm UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/9 "2018-05-08T12:05:15Z")

</div>

Okay. And are you sure you're looking in the right place for the stdout output? I think it ends up in one of the files in /var/log but I don't recall which one. Are you sure Logstash has loaded the expected configuration? Bumping up the loglevel to debug will shows exactly which configuration Logstash loads.

---

<div class="post-metadata">

**Author:** ![MrNerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrnerd/32/30763_2.png) [@MrNerd](https://discuss.elastic.co/u/MrNerd)\
**Post date:** [May 8, 2018, 1:04pm UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/10 "2018-05-08T13:04:09Z")

</div>

well I do think so but I'm not sure now I'm searching for a guide to send those pakets to elasticsearch.

Thanks you for worry

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2018, 1:04pm UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955/11 "2018-06-05T13:04:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.