Logstash logs two filebeat inputs

[rromanovic (Roman)]

Hi,
I've noticed that I have duplicate data in Elasticsearch. After some investigation I found following repeating error in my logstash log:

[ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Beats port=>5043, id=>"78ee533033a6b5d0cec43fe27609cb3811fefd9c-4", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_1794a609-4a85-46db-9b7c-6119a0ce4e9c", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60>
Error: Address already in use

This fragment of log got to my attention also:

[INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5043"}
[INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5043"}

I've checked and I can confirm that I'm running only one instance of filebeat and logstash.
I'm running Filebeat version 5.5.1 and Logstash version 5.5.1.

Does anyone have any idea how to fix this?

Thanks in advance!

[magnusbaeck (Magnus Bäck)]

It looks like you have more than one configuration file with a beats { port => 5043 } entry. Logstash reads all configuration files in /etc/logstash/conf.d (or wherever your configuration files are stored).

[rromanovic (Roman)]

Thank you @magnusbaeck

Indeed, there was another configuration file in conf.d folder.