Logstash binding problems

Elastic Stack Logstash
1

I am having an issue when running Logstash. When I run it with systemctl, it does not bind on port 5044 at all but logstash is not failing to run. When I run "logstash -f /etc/logstash/conf.d/" it binds to port 5044, but I cannot telnet to it from my other system running beats. I have checked and it is not a firewall issue. The one thing that stands out is that on the output of netstat it shows most other things binding on 127.0.0.1:9300 but for Logstash its :::5044. Any ideas?

Netstat output:

netstat -pltn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 10.144.44.156:5601 0.0.0.0:* LISTEN 6844/node
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1079/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1355/master
tcp6 0 0 127.0.0.1:9600 :::* LISTEN 7210/java
tcp6 0 0 10.144.44.156:9200 :::* LISTEN 6769/java
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 6769/java
tcp6 0 0 :::5044 :::* LISTEN 7210/java
tcp6 0 0 10.144.44.156:9300 :::* LISTEN 6769/java
tcp6 0 0 127.0.0.1:9300 :::* LISTEN

I'm using a bare bones config to test the bind at the moment so it looks like this:

input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => ["http://localhost:9200"]
}
}

2

It looks like it's only listening on the IPv6 interface. What happens if you set the beats input's host option to your IPv4 address? Have you seen Logstash only listens on IPv6 port?

3

It was an iptables issue, sorry to waste your time. I knew the main firewall configurations wouldn't have been changed but it seems that port 5044 was removed/not committed on restart maybe. For anyone else with this problem - double check your firewall!

In the end I didn't need to specify anything for the host option, it listened on IPv6 only and worked fine.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.