# Logstash listening on 3515 and 514
**URL:** https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461
**Category:** Logstash
**Created:** [July 13, 2015, 4:24pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461 "2015-07-13T16:24:10Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@cav10](https://discuss.elastic.co/u/cav10)
#### Post date: [July 13, 2015, 4:24pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/1 "2015-07-13T16:24:10Z")
I am trying to get logstash listening on 3515 and 514 so I can ship logs from my Windows client and Bro sensor. I am using CentOS 6.6. Any thoughts be awesome. I've been working on this for a few days.
Things I have done:
- verified the system isn't listening using netstat -antup and netstat -ano
- restarted ELK services
- used netcat and see it open the port
- Totally disabled iptables
- disabled selinux
- Checked Nxlog on windows system and it lists the below
* * *
## 2015-07-12 23:20:36 INFO connecting to 172.10.10.15:3515 2015-07-12 23:20:57 INFO reconnecting in 32 seconds 2015-07-12 23:20:57 ERROR couldn't connect to tcp socket on 172.10.10.15:3515; A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
- rechecked my config files in /etc/logstash/conf.d. Below are the input files. They are saved as separate files
### 3515 conf file
input {
tcp {
type =\> "WindowsEventLog"
port =\> "3515"
format =\> "json"
tags =\> ["Windows"]
}
}
### 514 conf file
input {
udp {
type =\> "syslog"
port =\> "514"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 13, 2015, 4:53pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/2 "2015-07-13T16:53:34Z")
Just checking: You _are_ running Logstash as root so that you're at all able to bind to port 514?
---
### Author:  [@cav10](https://discuss.elastic.co/u/cav10)
#### Post date: [July 13, 2015, 6:37pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/3 "2015-07-13T18:37:33Z")
Thank you for your response. I use 'sudo service log stash start'. Is there another way to run it as Root?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 14, 2015, 5:45am UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/4 "2015-07-14T05:45:20Z")
No, `sudo service logstash start` only runs the `service` command as root. To change which user Logstash runs as, change the LS\_USER variable in /etc/sysconfig/logstash. But please avoid running Logstash as root.
---
### Author:  [@Rinat](https://discuss.elastic.co/u/Rinat)
#### Post date: [January 31, 2017, 4:50pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/5 "2017-01-31T16:50:29Z")
Is there any other way to use port 514 for Logstash without running it as root?! I was under assumption that yes, since the documentation just points out how to configure logstash.conf file to receive syslog messages and it's using port 514 as an example. Makes one think that there is a an easy way to do so.
Please advice,
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461/6 "2017-07-06T04:29:02Z")