# Logstash not listening port 5044 even when we configured the beats

**URL:** <https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792>\
**Category:** Logstash\
**Created:** [July 27, 2022, 7:36pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792 "2022-07-27T19:36:52Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 27, 2022, 7:36pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/1 "2022-07-27T19:36:52Z")

</div>

input {  
beats {  
type =\> beats  
host =\> "localhost"  
port =\> 5044  
}

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 27, 2022, 7:37pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/2 "2022-07-27T19:37:21Z")

</div>

it is always listens to the 9600 only

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 27, 2022, 9:18pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/3 "2022-07-27T21:18:58Z")

</div>

take out this line.. and try again.

`# host => "localhost"`

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 27, 2022, 9:59pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/4 "2022-07-27T21:59:56Z")

</div>

Still not working

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 27, 2022, 10:59pm UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/5 "2022-07-27T22:59:42Z")

</div>

You are going to need to provide more information if you want help.

What version are you on?

How do you know it is not working / how did you test?

What did the logstash startup logs show?

The logs should show somthing like this if it started succesfully.

```auto
2022-07-27T16:12:45,182][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.47}
[2022-07-27T16:12:45,204][INFO][logstash.inputs.beats][main] Starting input listener {:address=>"0.0.0.0:5044"}
[2022-07-27T16:12:45,215][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}

```

And if not something like

```auto
[2022-07-27T16:15:22,216][INFO][logstash.inputs.beats][main] Starting input listener {:address=>"0.0.0.0:5044"}
[2022-07-27T16:17:35,779][INFO][org.logstash.beats.Server][main][cb9c0e56545925dd4243dfb98dfe230729cbf8579eaa7521ef7bb161b15019d2] Starting server on port: 5044
[2022-07-27T16:17:42,050][ERROR][logstash.javapipeline][main][cb9c0e56545925dd4243dfb98dfe230729cbf8579eaa7521ef7bb161b15019d2] A plugin had an unrecoverable error. Will restart this plugin.
  Pipeline_id:main
  Plugin: <LogStash::Inputs::Beats port=>5044, id=>"cb9c0e56545925dd4243dfb98dfe230729cbf8579eaa7521ef7bb161b15019d2", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_c29fc438-7de4-4977-9b65-37c420c1f308", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, add_hostname=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.3, cipher_suites=>["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>16>
  Error: Address already in use
  Exception: Java::JavaNet::BindException
  Stack: sun.nio.ch.Net.bind0(Native Method)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:459)
.....

```

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 2:47am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/6 "2022-07-28T02:47:36Z")

</div>

I tried to run in the docker container and exposed the ports 5044 .Logstash is running.But when I try to curl with 5044 it is not listening.using the netstat -plnt.

Please help me to check on this issue.Id possible please provide any link to connect with you to show what exactly the problem is.

Thanks,  
Kala

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 28, 2022, 3:31am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/7 "2022-07-28T03:31:26Z")

</div>

Hi @KALAVATHI_YALAMANCHA

This is a community forum not personal/ commercial support...

This is the first time you've mentioned Docker

The best way to get help is to be complete in the information you're providing, not just little pieces of information.

Share your docker file / compose / docker command and the logs.

Did you read the docs?

> **[Configuring Logstash for Docker | Logstash Reference \[8.3\] | Elastic](https://www.elastic.co/guide/en/logstash/current/docker-config.html)**

Sounds to me like like your logstash conf file is not being read / used.

You still have not provided logs nor the commands you are starting logstash nor you configuration... We can't help until you do

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 3:53am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/9 "2022-07-28T03:53:14Z")

</div>

docker run -it imageid

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 28, 2022, 4:08am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/10 "2022-07-28T04:08:06Z")

</div>

Your issue has nothing to do with Logstash, it is a docker issue, you are not exposing the port, please check the [docker documentation](https://docs.docker.com/engine/reference/builder/#expose).

> The `EXPOSE` instruction **does not actually publish** the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published. To **actually publish** the port when running the container, use the `-p` flag on `docker run` to publish and map one or more ports, or the `-P` flag to publish all exposed ports and map them to high-order ports.

You need to use `-p 5044:5044` in your docker run command.

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 4:12am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/11 "2022-07-28T04:12:25Z")

</div>

i dont run the docker command manually.I have created ecs task in aws and using this image the task will run.Is there any way to run automatically without providng the port manually?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 28, 2022, 4:20am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/12 "2022-07-28T04:20:35Z")

</div>

I do not use docker much nor AWS so I can not help further, but your issue is that you are not publishing the port.

Just having `EXPOSE port-number` in your dockerfile will not publish the port, you need to tell docker which is the port you will use in the docker host and the internal port in the docker container.

How you do that depends entirely in the way you are starting docker, you could edit your task to pass the `-p 5044:5044` parameter, you can use `docker-compose` and have the ports in the configuration and probably there are many other ways, it is better for you to check on a docker forum since your issue is not related to any Elastic products.

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 4:32am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/13 "2022-07-28T04:32:01Z")

</div>

curl: (56) Recv failure: Connection reset by peer when i ping the localhost with 5044 port

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 28, 2022, 5:09am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/14 "2022-07-28T05:09:58Z")

</div>

@KALAVATHI_YALAMANCHA I agree with @leandrojmp this is a docker network issue not exposing ports... your docker execution is incorrect and the 5044 is not actually expose on the host network.

> **The `EXPOSE` instruction does not actually publish the port.** It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published. To actually publish the port when running the container, use the `-p` flag on `docker run` to publish and map one or more ports, or the `-P` flag to publish all exposed ports and map them to high-order ports.

Here is a sample complete docker-compose solution

```auto
hyperion:logstash sbrown$ pwd
/Users/sbrown/workspace/elastic-install/docker/logstash
hyperion:logstash sbrown$ ls
config/ docker-compose.yml pipeline/
hyperion:logstash sbrown$ 
hyperion:logstash sbrown$ cat docker-compose.yml 
version: "3.3"

services:
  logstash:
    image: docker.elastic.co/logstash/logstash:8.3.2
    ports:
      - 5044:5044
    volumes:
      - ~/workspace/elastic-install/docker/logstash/pipeline/:/usr/share/logstash/pipeline/:ro
      - ~/workspace/elastic-install/docker/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ~/workspace/elastic-install/docker/logstash/config/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro

hyperion:logstash sbrown$ 
hyperion:logstash sbrown$ cat config/logstash.yml 
http.host: "0.0.0.0"
config.reload.automatic: true

hyperion:logstash sbrown$ 
hyperion:logstash sbrown$ cat config/pipelines.yml 
- pipeline.id: main
  path.config: "/usr/share/logstash/pipeline"

hyperion:logstash sbrown$ 
hyperion:logstash sbrown$ cat pipeline/logstash-sample.conf 
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://host.docker.internal:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    action => "create"
  }
  # stdout {
  # codec => "rubydebug"
  # }
}
hyperion:logstash sbrown$ 

```

See my `docker ps` shows the mapping to between internal and external ports your only shows one side of the mapping thus the port is not expose to the host... it never will be with your current setup.

`0.0.0.0:5044->5044/tcp`

```auto
hyperion:docker sbrown$ docker ps | grep logstash
2b10a664b693 docker.elastic.co/logstash/logstash:8.3.2 "/usr/local/bin/dock…" 6 minutes ago Up 6 minutes 0.0.0.0:5044->5044/tcp, 9600/tcp logstash-logstash-1

```

```auto
hyperion:docker sbrown$ sudo lsof -i -P | grep LISTEN | grep :$PORT | grep sbrown
com.docke 4207 sbrown 63u IPv6 0xfed9fc326875e059 0t0 TCP *:5601 (LISTEN)
com.docke 4207 sbrown 133u IPv6 0xfed9fc3268760a59 0t0 TCP *:9200 (LISTEN)
com.docke 4207 sbrown 182u IPv6 0xfed9fc3268757059 0t0 TCP *:5044 (LISTEN)

```

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 5:17am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/15 "2022-07-28T05:17:29Z")

</div>

Thanks for your reply. I am not getting the output for the incoming beats.Can you please help to suggest on this.  
i am sending winlog beats but i could nt able to find the beats in the logstash output.Please help to check on this?

i have configured the winlog beat output to send to logstash like below  
output.logstash:

# The Logstash hosts

hosts: ["x.x.x.x:5044","x.x.x.x:5044"]  
loadbalance: true

i made the connection by using the test output  
PS C:\Users\Administrator\Downloads\winlogbeat\> .\winlogbeat.exe test output  
logstash: x.x.x.x:5044...  
connection...  
parse host... OK  
dns lookup... OK  
addresses: x.x.x.x  
dial up... OK  
TLS... WARN secure connection disabled  
talk to server... OK

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 28, 2022, 5:22am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/16 "2022-07-28T05:22:21Z")

</div>

So looks like perhaps you got the logstash port opened?

When you run winlogbeat does it show connected?

if youy logstash conf looks like

```auto
nput {
beats {
port => 5044
type => beats
}
}
output
{
stdout { }
}

```

then the output would be in the stdout of the docker container... no where else...

I would put

`stdout { codec => "rubydebug"}`

Keep working on it...

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 28, 2022, 5:27am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/18 "2022-07-28T05:27:13Z")

</div>

You will need to exec into the docker container to see the output you are just writing it to `stdout` inside the container...

Where do you actually want to send the results?

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 5:30am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/19 "2022-07-28T05:30:17Z")

</div>

i want to see the output in the logs itself.

---

<div class="post-metadata">

**Author:** ![KALAVATHI\_YALAMANCHA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalavathi_yalamancha/32/100884_2.png) [@KALAVATHI\_YALAMANCHA](https://discuss.elastic.co/u/KALAVATHI_YALAMANCHA)\
**Post date:** [July 28, 2022, 5:34am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/20 "2022-07-28T05:34:16Z")

</div>

Thank you so much both of you.I got the desired output.For filtering can you suggest any format for windows logs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:36am UTC](https://discuss.elastic.co/t/logstash-not-listening-port-5044-even-when-we-configured-the-beats/310792/21 "2022-11-04T08:36:22Z")

</div>