Logstash error on Raspberry Pi 4 running Ubuntu Server 20.04.2

Elastic Stack Logstash
1

Hello, I'm running 64-bit version of Ubuntu Server 20.04.2 on a Raspberry Pi 4 (4 GB RAM, hardware revision 1.1)

  1. I've installed logstash using apt.
  2. Configuration being used on this Raspberry Pi work on a different board but that board is running Raspbian OS with hacked version of logstash (Logstash 7.x on raspberry pi 4 - #2 by sadoht)
  3. With Ubuntu OS, following is the error message from /var/log/syslog
Feb 13 07:40:01 hostname logstash[2426]:   Error: Address already in use
Feb 13 07:40:01 hostname logstash[2426]:   Exception: Java::JavaNet::BindException
Feb 13 07:40:01 hostname logstash[2426]:   Stack: sun.nio.ch.Net.bind0(Native Method)
Feb 13 07:40:01 hostname logstash[2426]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:455)
Feb 13 07:40:01 hostname logstash[2426]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:447)
> Feb 13 07:31:55 hostname logstash[2426]: [2021-02-13T07:31:55,215][ERROR][logstash.javapipeline    ][main][9292d2cf76564d54fcded4e59eb432d6c98cea0803d3715488f741b97c57e5c4] A plugin had an unrecoverable error. Will restart this plugin.
> Feb 13 07:31:55 hostname logstash[2426]:   Pipeline_id:main
> Feb 13 07:31:55 hostname logstash[2426]:   Plugin: <LogStash::Inputs::Beats port=>5074, id=>"9292d2cf76564d54fcded4e59eb432d6c98cea0803d3715488f741b97c57e5c4", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_08546d1f-20bc-458e-8613-e1879ab47669", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, add_hostname=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>4>
> Feb 13 07:31:55 hostname logstash[2426]:   Error: Address already in use
> Feb 13 07:31:55 hostname logstash[2426]:   Exception: Java::JavaNet::BindException
> Feb 13 07:31:55 hostname logstash[2426]:   Stack: sun.nio.ch.Net.bind0(Native Method)
> Feb 13 07:31:55 hostname logstash[2426]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:455)
> Feb 13 07:31:55 hostname logstash[2426]: sun.nio.ch.Net.bind(sun/nio/ch/Net.java:447)
> Feb 13 07:31:55 hostname logstash[2426]: sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:227)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:134)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:550)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1334)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:506)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:491)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:973)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:248)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:356)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:164)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:472)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:500)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.util.concurrent.SingleThreadEventExecutor$4.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:989)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.util.internal.ThreadExecutorMap$2.run(io/netty/util/internal/ThreadExecutorMap.java:74)
> Feb 13 07:31:55 hostname logstash[2426]: io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30)
> Feb 13 07:31:55 hostname logstash[2426]: java.lang.Thread.run(java/lang/Thread.java:834)
> Feb 13 07:31:56 hostname logstash[2426]: [2021-02-13T07:31:56,224][INFO ][org.logstash.beats.Server][main][9292d2cf76564d54fcded4e59eb432d6c98cea0803d3715488f741b97c57e5c4] Starting server on port: 5074

I am able to connect to the port (5074), however I do not see any logs flowing.

What is the problem? Are there more logs required to diagnose this?

Thank you very much.

2

Hi!

Are you trying to listen traffic on 0.0.0.0:5074?

The error seems to point that that address is already in use. You can use 'ss' to see which process is using that port

ss -nlp | grep 5074

You can also change the input port to other number to see if that solves the issue

3

Hello, thank you very much for your reply. I just reflashed my RPi and it works perfects.

We will never know :smiley:

Have a wonderful time ahead. :slight_smile:

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.