# Logstash is not listening on any port

**URL:** <https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088>\
**Category:** Logstash\
**Created:** [March 22, 2016, 10:06am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088 "2016-03-22T10:06:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![guy.naftaly](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@guy.naftaly](https://discuss.elastic.co/u/guy.naftaly)\
**Post date:** [March 22, 2016, 10:06am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/1 "2016-03-22T10:06:18Z")

</div>

hello all,

I installed Elasticsearch/Logstash/Kibana on CentOS 7 .  
Kibana and Elasticsearch works fine.  
Logstash version logstash-2.2  
I have an issue with the Logstash – it is not listening on the input ports  
I created new logstash config file: /etc/logstash/conf.d/logstash.conf  
I tested the config file with service logstash configtest and got Configuration OK  
There are no errors at /var/log/logstash/logstash.log or /var/log/logstash/logstash.err  
I have another CentOS 7 server which Logstash woks there fine with same config life.  
This is the logstash.conf file content:  
input {  
lumberjack {  
port =\> 5043  
type =\> "haproxy"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

input {  
tcp {  
type =\> "VMware"  
port =\> "5000"  
}  
}

filter {  
if [type] == "haproxy" {  
grok {  
match =\> ["message", "%{HAPROXYHTTP}"]  
}  
}  
if [type] == "VMware" {  
grok {  
break\_on\_match =\> true  
match =\> [  
"message", "\<%{POSINT:syslog\_pri}\>%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{SYSLOGPROG:syslog\_program}: (?(?\<message\_system\_info\>(?:[%{DATA:message\_thread\_id} %{DATA:syslog\_level} '%{DATA:message\_service}'\ ?%{DATA:message\_opID}])) [%{DATA:message\_service\_info}]\ (?\<syslog\_message\>(%{GREEDYDATA})))",  
"message", "\<%{POSINT:syslog\_pri}\>%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{SYSLOGPROG:syslog\_program}: (?(?\<message\_system\_info\>(?:[%{DATA:message\_thread\_id} %{DATA:syslog\_level} '%{DATA:message\_service}'\ ?%{DATA:message\_opID}])) (?\<syslog\_message\>(%{GREEDYDATA})))",  
"message", "\<%{POSINT:syslog\_pri}\>%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{SYSLOGPROG:syslog\_program}: %{GREEDYDATA:syslog\_message}"  
]  
}  
}  
}

output {  
elasticsearch { hosts =\> localhost }  
stdout { codec =\> rubydebug }  
}

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2016, 10:15am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/2 "2016-03-22T10:15:34Z")

</div>

Have you checked with e.g. netstat or lsof whether something's listening on those ports? Could there by a firewall blocking the access? Have you started Logstash with `--debug` to make sure it's seeing the configuration you expect it to?

---

<div class="post-metadata">

**Author:** ![guy.naftaly](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@guy.naftaly](https://discuss.elastic.co/u/guy.naftaly)\
**Post date:** [March 22, 2016, 11:33am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/3 "2016-03-22T11:33:42Z")

</div>

#I checked with netstat and no one is listening on the input port 5043:  
netstat -anp | grep 5043  
unix 3 [] STREAM CONNECTED 61504390 20518/systemd-journ /run/systemd/journal/stdout  
unix 3 [] STREAM CONNECTED 61504389 29322/python

#I checked with telnet to the local host so no firewall is involved:  
telnet 127.0.0.1 5043  
Trying 127.0.0.1...  
telnet: connect to address 127.0.0.1: Connection refused

#I allowed the port in the firewall and stopped the firewall:  
firewall-cmd --zone=public --add-port=5043/tcp --permanent  
firewall-cmd --list-all  
ports: 9200/tcp 5601/tcp 5043/tcp 5000/tcp 9300/tcp  
#still I get:  
telnet 127.0.0.1 5043  
Trying 127.0.0.1...  
telnet: connect to address 127.0.0.1: Connection refused

---

<div class="post-metadata">

**Author:** ![guy.naftaly](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@guy.naftaly](https://discuss.elastic.co/u/guy.naftaly)\
**Post date:** [March 23, 2016, 7:41am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/4 "2016-03-23T07:41:58Z")

</div>

# I started logstash with debug

service logstash start --debug  
logstash started.

---

<div class="post-metadata">

**Author:** ![Daniel\_Fosterman](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Daniel\_Fosterman](https://discuss.elastic.co/u/Daniel_Fosterman)\
**Post date:** [January 30, 2017, 3:43pm UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/5 "2017-01-30T15:43:43Z")

</div>

Did you get this resolved? I hope so it's been almost a year. =) I am having a similar issue with the beats plugin.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/logstash-is-not-listening-on-any-port/45088/6 "2017-07-06T04:29:03Z")

</div>