LOGSTASH Config file error, doesn't like host assigning but it requires one

Elastic Stack Logstash
1

I'm trying to configure logstash and this is the error im getting:

{:timestamp=>"2016-06-17T11:36:27.128000+0100", :message=>"Could not start TCP server: Address in use", :host=>"elk.etechdc.local", :port=>3515, :level=>:error}

Logstash Conf is:
input {
tcp {
codec => json_lines { charset => CP1252 }
port => 3515
host => "elk.etechdc.local"
tags => [ "tcpjson" ]
}
}
filter {
date {
locale => "en"
timezone => "Etc/GMT"
match => [ "EventTime", "YYYY-MM-dd HH:mm:ss" ]
}
}
output {
elasticsearch {
hosts => localhost
}
stdout { codec => rubydebug }
}

2

Some process is already listening on port 3515. If you're starting Logstash as a daemon with e.g. service logstash start or if you're passing the path to a directory via -f, make sure you the configuration file directory doesn't contain any unexpected files like e.g. a backup file that contains the same tcp input.

3

I've checked and the only other process is "JAVA.EXE" which I imagine is logstash its self? Even if I change the port its still giving the same error.

4

java.exe could be a Logstash instance. You can e.g. use Process Explorer to see the command line of any process.

5

it is logstash, if i run: logstash.bat -f logstash.json >> log.log
this is what it dumps:

{:timestamp=>"2016-06-17T13:44:03.934000+0100", :message=>"Could not start TCP server: Address in use", :host=>"elk.etechdc.local", :port=>3515, :level=>:error}
{:timestamp=>"2016-06-17T13:44:03.934000+0100", :message=>"Pipeline aborted due to error", :exception=>#<Errno::EADDRINUSE: Address already in use - bind - Address already in use: bind>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:118:in initialize'", "org/jruby/RubyIO.java:853:innew'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:244:in new_server_socket'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-3.0.4/lib/logstash/inputs/tcp.rb:79:inregister'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:330:in start_inputs'", "org/jruby/RubyArray.java:1613:ineach'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:329:in start_inputs'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:180:instart_workers'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/pipeline.rb:136:in run'", "c:/ulyaoth/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.1-java/lib/logstash/agent.rb:465:instart_pipeline'"], :level=>:error}
{:timestamp=>"2016-06-17T13:44:06.997000+0100", :message=>"stopping pipeline", :id=>"main"}

The CMD command won't run if i change the port to anything...

6

Is the port busy if you're not running Logstash?