# Logstash Error "Error: Address already in use"

**URL:** <https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601>\
**Category:** Logstash\
**Created:** [January 24, 2019, 12:25pm UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601 "2019-01-24T12:25:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sandy6](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sandy6](https://discuss.elastic.co/u/sandy6)\
**Post date:** [January 24, 2019, 12:25pm UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601/1 "2019-01-24T12:25:28Z")

</div>

Hi,  
I have apache pipeline with multiple match patterns. Here is the code

input {  
beats {  
port =\> 5044  
id =\> "apache-access"  
}  
}  
filter {  
if [fields][log] == "apache-access" {  
grok {  
match =\> [  
"message", '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}',  
"message", '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) (?:-|%{NUMBER:tosinsec:int}) (?:-|%{NUMBER:tosinmicrosec:int})'  
]  
}  
}

When i run with "--config.test\_and\_exit" flag, it says "Config Validation Result: OK". But when i start logstash service i am seeing this error in logstash log file

Error: Address already in use  
Exception: Java::JavaNet::BindException

---

<div class="post-metadata">

**Author:** ![sandy6](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sandy6](https://discuss.elastic.co/u/sandy6)\
**Post date:** [January 24, 2019, 12:58pm UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601/2 "2019-01-24T12:58:17Z")

</div>

I am trying to write one pipeline to parse the below logs

127.0.0.1 - - [09/Nov/2018:10:58:28 +0530] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (X11; Linux x86\_64; rv:60.0) Gecko/20100101 Firefox/60.0"  
127.0.0.1 - - [09/Nov/2018:10:58:28 +0530] "GET test.min.css HTTP/1.1" 200 19341 "[http://127.0.0.1/](http://127.0.0.1/)" "Mozilla/5.0 (X11; Linux x86\_64; rv:60.0) Gecko/20100101 Firefox/60.0"  
127.0.0.1 - - [17/Jan/2019:11:43:26 +0530] "GET /theme/css/test.css HTTP/1.1" 200 1170 0 285  
127.0.0.1 - - [17/Jan/2019:11:43:26 +0530] "GET /theme/css/test.css HTTP/1.1" 200 314 0 240

some logs have "referer & user-agent" and some doesn't have. Other logs have extra data like "time to serve in sec and milliseconds".

Please tell me how to write one pipeline with multiple matches to work for both types of logs.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2019, 3:18pm UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601/3 "2019-01-24T15:18:49Z")

</div>

I would use dissect to do the initial parsing

```
    dissect { mapping => { "message" => '%{clientIP} - - [%{ts}] "%{method} %{uri} %{protocol}" %{status} %{something} %{restOfLine}' } }

```

Then use a grok with multiple patterns to do the rest

```
grok {
    match => {
        "restOfLine" => [
            "^%{INT:i1} %{INT:i2}",
            "^%{QS:referer} %{QS:useragent}"
        ]
    }
}
```

---

<div class="post-metadata">

**Author:** ![sandy6](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sandy6](https://discuss.elastic.co/u/sandy6)\
**Post date:** [January 25, 2019, 4:38am UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601/4 "2019-01-25T04:38:35Z")

</div>

> [@Badger](#):
>
> dissect { mapping =\> { "message" =\> '%{clientIP} - - [%{ts}] "%{method} %{uri} %{protocol}" %{status} %{something} %{restOfLine}' } }

Thanks Badger. I will try your solution. Is there is anything wrong with my code?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2019, 4:38am UTC](https://discuss.elastic.co/t/logstash-error-error-address-already-in-use/165601/5 "2019-02-22T04:38:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.