# Logstash does not open Port for Data-Input

**URL:** <https://discuss.elastic.co/t/logstash-does-not-open-port-for-data-input/302305>\
**Category:** Logstash\
**Created:** [April 13, 2022, 8:47am UTC](https://discuss.elastic.co/t/logstash-does-not-open-port-for-data-input/302305 "2022-04-13T08:47:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [April 13, 2022, 8:47am UTC](https://discuss.elastic.co/t/logstash-does-not-open-port-for-data-input/302305/1 "2022-04-13T08:47:21Z")

</div>

Hi there,  
soo i'm trying to get a new cluster to work - everythings setup fine.  
We're using CentOS 7, Elasticsearch 7.15, Logstash 7.15.

The service is running fine - no errors when running it in debug mode.  
There's also a confirmation that my config files are ok:

> ...  
> [2022-04-13T10:21:49,955][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::Elasticsearch/@pipeline = nil  
> [2022-04-13T10:21:49,955][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::Elasticsearch/@ilm\_enabled = "auto"  
> [2022-04-13T10:21:49,956][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::Elasticsearch/@ilm\_pattern = "{now/d}-000001"  
> [2022-04-13T10:21:49,956][DEBUG][logstash.outputs.elasticsearch] config LogStash::Outputs::Elasticsearch/@ilm\_policy = "logstash-policy"  
> Configuration OK

If i check for the specified Port for this pipeline (5140) it shows up when i check it locally on the machine, also i've setup a firewall ruleset for this:

> [root@randomserver02 user]# iptables -L | grep 5140  
> ACCEPT udp -- anywhere anywhere udp dpt:5140  
> ACCEPT udp -- anywhere anywhere udp dpt:5140 ctstate NEW

> [root@randomserver02 user]# netstat -tulnp | grep 5140  
> udp 0 0 0.0.0.0:5140 0.0.0.0:\* 2797/java

But there are no logs comming in from the source. If i check the port with nmap from a remote machine - it tells me that there is no open Port? I don't really get what COULD be wrong - any ideas?

> [user@randomserver01 elasticsearch]$ nmap -p5140 X.X.X.X  
> Starting Nmap 6.40 ( [http://nmap.org](http://nmap.org) ) at 2022-04-13 10:42 CEST  
> Nmap scan report for [randomserver02.domain.com](http://randomserver02.domain.com) (X.X.X.X)  
> Host is up (0.00086s latency).  
> PORT STATE SERVICE  
> 5140/tcp closed unknown

Kind regards,  
Moritz

---

<div class="post-metadata">

**Author:** ![abrx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abrx/32/43881_2.png) [@abrx](https://discuss.elastic.co/u/abrx)\
**Post date:** [April 20, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-does-not-open-port-for-data-input/302305/2 "2022-04-20T13:06:39Z")

</div>

Your last test check the port with tcp but you opened it for udp, maybe something there ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2022, 1:07pm UTC](https://discuss.elastic.co/t/logstash-does-not-open-port-for-data-input/302305/3 "2022-05-18T13:07:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.