### Author:  [@Bruno\_Dias](https://discuss.elastic.co/u/Bruno_Dias)
#### Post date: [December 18, 2017, 2:36pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/1 "2017-12-18T14:36:43Z")
Hello, I'm trying to direct the pfsense logs to elasticsearch, all the tutorials I've found use the UDP port 5140, my pfsense can send the logs to that server on that port, but the logstash at startup shows the error below:
Starting UDP listener {: address =\> "0.0.0.0:5140"}
UDP listener died {: exception =\> # \
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 2:40pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/2 "2017-12-18T14:40:07Z")
What does `grep udp /etc/logstash/conf.d/*` (or wherever you store your config files) result in? How about `netstat -an | grep 5140` when Logstash isn't running?
---
### Author:  [@Bruno\_Dias](https://discuss.elastic.co/u/Bruno_Dias)
#### Post date: [December 18, 2017, 2:56pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/3 "2017-12-18T14:56:43Z")
root@logs:/# grep udp /etc/logstash/conf.d/\*
/etc/logstash/conf.d/01-inputs.conf:#udp syslogs stream via 5140
/etc/logstash/conf.d/01-inputs.conf: udp {
root@logs:/# netstat -an | grep 5140
tcp 0 0 0.0.0.0:5140 0.0.0.0:\* OUÇA
tcp6 0 0 :::5140 :::\* OUÇA
udp 0 0 0.0.0.0:5140 0.0.0.0:\*
udp6 0 0 :::5140 :::\*
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 3:06pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/4 "2017-12-18T15:06:52Z")
Well, the netstat output shows that you have a process listening on that port. Run `netstat -tulpn` to get information about which process it is.
---
### Author:  [@Bruno\_Dias](https://discuss.elastic.co/u/Bruno_Dias)
#### Post date: [December 18, 2017, 5:21pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/5 "2017-12-18T17:21:47Z")
root@logs:/# netstat -tulpn
Conexões Internet Ativas (somente servidores)
Proto Recv-Q Send-Q Endereço Local Endereço Remoto Estado PID/Program name
tcp 0 0 0.0.0.0:5140 0.0.0.0:\* OUÇA 1889/rsyslogd
tcp 0 0 0.0.0.0:22 0.0.0.0:\* OUÇA 1061/sshd
tcp 0 0 127.0.0.1:6010 0.0.0.0:\* OUÇA 1224/0
tcp 0 0 0.0.0.0:5601 0.0.0.0:\* OUÇA 1431/node
tcp6 0 0 127.0.0.1:9200 :::\* OUÇA 1300/java
tcp6 0 0 ::1:9200 :::\* OUÇA 1300/java
tcp6 0 0 :::5140 :::\* OUÇA 1889/rsyslogd
tcp6 0 0 127.0.0.1:9300 :::\* OUÇA 1300/java
tcp6 0 0 ::1:9300 :::\* OUÇA 1300/java
tcp6 0 0 :::22 :::\* OUÇA 1061/sshd
tcp6 0 0 ::1:6010 :::\* OUÇA 1224/0
udp 0 0 0.0.0.0:5140 0.0.0.0:\* 1889/rsyslogd
udp6 0 0 :::5140 :::\* 1889/rsyslogd
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 6:43pm UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/6 "2017-12-18T18:43:59Z")
Okay, so rsyslogd already hogs port 5140.
---
### Author:  [@Bruno\_Dias](https://discuss.elastic.co/u/Bruno_Dias)
#### Post date: [December 19, 2017, 9:46am UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/7 "2017-12-19T09:46:51Z")
if I change the logstash port to 5141 can I get the logs that are coming from pfsense to rsyslog on port 5140?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 19, 2017, 9:55am UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/8 "2017-12-19T09:55:17Z")
I suppose you could modify the rsyslog configuration to pass on the messages it receives to Logstash.
---
### Author:  [@Bruno\_Dias](https://discuss.elastic.co/u/Bruno_Dias)
#### Post date: [December 20, 2017, 10:36am UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/9 "2017-12-20T10:36:29Z")
Thanks for the help, I changed the logstash port and set up rsyslog to send the logs to logstash, it works fine 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2018, 10:36am UTC](https://discuss.elastic.co/t/logstash-error-eaddrinuse-address-already-in-use/112251/10 "2018-01-17T10:36:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.