# Logstash logs two filebeat inputs

**URL:** https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039
**Category:** Logstash
**Created:** [November 9, 2017, 12:00pm UTC](https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039 "2017-11-09T12:00:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![rromanovic](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rromanovic](https://discuss.elastic.co/u/rromanovic)
#### Post date: [November 9, 2017, 12:00pm UTC](https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039/1 "2017-11-09T12:00:46Z")

</div>

Hi,  
I've noticed that I have duplicate data in Elasticsearch. After some investigation I found following repeating error in my logstash log:

[ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Beats port=\>5043, id=\>"78ee533033a6b5d0cec43fe27609cb3811fefd9c-4", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Plain id=\>"plain\_1794a609-4a85-46db-9b7c-6119a0ce4e9c", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, ssl\_verify\_mode=\>"none", include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message", tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60\>  
Error: Address already in use

This fragment of log got to my attention also:

[INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5043"}  
[INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5043"}

I've checked and I can confirm that I'm running only one instance of filebeat and logstash.  
I'm running Filebeat version 5.5.1 and Logstash version 5.5.1.

Does anyone have any idea how to fix this?

Thanks in advance!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 1:36pm UTC](https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039/2 "2017-11-09T13:36:25Z")

</div>

It looks like you have more than one configuration file with a `beats { port => 5043 }` entry. Logstash reads _all_ configuration files in /etc/logstash/conf.d (or wherever your configuration files are stored).

---

<div class="post-metadata">

### Author: ![rromanovic](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@rromanovic](https://discuss.elastic.co/u/rromanovic)
#### Post date: [November 9, 2017, 2:07pm UTC](https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039/3 "2017-11-09T14:07:25Z")

</div>

Thank you @magnusbaeck🙂

Indeed, there was another configuration file in conf.d folder.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2017, 2:07pm UTC](https://discuss.elastic.co/t/logstash-logs-two-filebeat-inputs/107039/4 "2017-12-07T14:07:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.