Logstash logs two filebeat inputs

Elastic Stack Logstash
1

Hi,
I've noticed that I have duplicate data in Elasticsearch. After some investigation I found following repeating error in my logstash log:

[ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Plugin: <LogStash::Inputs::Beats port=>5043, id=>"78ee533033a6b5d0cec43fe27609cb3811fefd9c-4", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_1794a609-4a85-46db-9b7c-6119a0ce4e9c", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60>
Error: Address already in use

This fragment of log got to my attention also:

[INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5043"}
[INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5043"}

I've checked and I can confirm that I'm running only one instance of filebeat and logstash.
I'm running Filebeat version 5.5.1 and Logstash version 5.5.1.

Does anyone have any idea how to fix this?

Thanks in advance!

2

It looks like you have more than one configuration file with a beats { port => 5043 } entry. Logstash reads all configuration files in /etc/logstash/conf.d (or wherever your configuration files are stored).

3

Thank you @magnusbaeck :slight_smile:

Indeed, there was another configuration file in conf.d folder.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.