still haven't received updated logs. the only thing running is logstash on port 5000. there is only one file in /etc/logstash/conf.d/ which is what i showed above. all forwarder show connected to main host.
i beleve it is something to do with logstash speaking with the forwarder. I ran the following command "./bin/logstash -f /etc/logstash/conf.d/puppetstash.conf --configtest" at receieved a
"Configuration OK".. after i tried to now actually run the command "s./bin/logstash -f /etc/logstash/conf.d/puppetstash.conf" and recieved "The error reported is:
Address already in use - bind - Address already in use
" .. any idea what the issue may be?
or it could be the log forwarder is still not sending data?
or it could be the log forwarder is still not sending data?
It could be any number of things, but address the "address already in use" problem first. Starting Logstash with --verbose or --debug may give additional clues.
how do i do that?
Add --debug to the Logstash command line. And again, double-check the lsof output. You either have two Logstash instances running at the same time or a single instance that tries to listed on port 5000 from two places.
i got a logstash startup completed... anything i should be looking for in particular?
Well, you should be interested in why it seems like Logstash is trying to listen on port 5000 twice. For example, I believe Logstash dumps its configuration at the beginning. Good luck.