# Logstash dont receive log

**URL:** <https://discuss.elastic.co/t/logstash-dont-receive-log/145642>\
**Category:** Logstash\
**Created:** [August 23, 2018, 4:24am UTC](https://discuss.elastic.co/t/logstash-dont-receive-log/145642 "2018-08-23T04:24:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilyas\_Ahsan](https://avatars.discourse-cdn.com/v4/letter/i/4af34b/32.png) [@Ilyas\_Ahsan](https://discuss.elastic.co/u/Ilyas_Ahsan)\
**Post date:** [August 23, 2018, 4:24am UTC](https://discuss.elastic.co/t/logstash-dont-receive-log/145642/1 "2018-08-23T04:24:09Z")

</div>

Hi

i have problem on logstash, my logstash dont receive any logstash. how do i debug this? because i have no get error

this is my logstash input and output.

input {  
syslog {  
port =\> 5043  
add\_field =\> {"log\_type" =\> "cdr\_syslog"}  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost"  
index =\> "all-syslog\_cdr-%{+YYYY.MM.dd}"  
}  
if "\_grokparsefailure" not in [tags] and "\_groktimeout" not in [tags] {  
elasticsearch {  
hosts =\> localhost  
index =\> "syslog\_cdr-%{+YYYY.MM.dd}"  
}  
}  
else {  
elasticsearch {  
hosts =\> "localhost"  
index =\> "error-syslog\_cdr-%{+YYY.MM.dd}"  
}  
}  
}

thank you

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2018, 6:08am UTC](https://discuss.elastic.co/t/logstash-dont-receive-log/145642/2 "2018-08-23T06:08:27Z")

</div>

Can other hosts connect to port 5043 on your machine? If you capture the network traffic, is anything being transmitted? I suggest you temporarily replace your elasticsearch outputs with a `stdout { codec => rubydebug }` output to remove sources of errors. What you send something by hand using e.g. telnet or netcat, is it getting through?

---

<div class="post-metadata">

**Author:** ![Ilyas\_Ahsan](https://avatars.discourse-cdn.com/v4/letter/i/4af34b/32.png) [@Ilyas\_Ahsan](https://discuss.elastic.co/u/Ilyas_Ahsan)\
**Post date:** [August 23, 2018, 7:39am UTC](https://discuss.elastic.co/t/logstash-dont-receive-log/145642/3 "2018-08-23T07:39:34Z")

</div>

thank you for reply,

i have debug and found issue

[WARN] 2018-08-23 14:39:08.277 [Ruby-0-Thread-16: :1] syslog - syslog listener died {:protocol=\>:udp, :address=\>"0.0.0.0:5043", :exception=\>#\<Errno::EADDRINUSE: Address already in use - bind - Address already in use\>, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:190:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:149:in`udp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:110:in`block in run'"]}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2018, 7:39am UTC](https://discuss.elastic.co/t/logstash-dont-receive-log/145642/4 "2018-09-20T07:39:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.