Logstash port 514 input error

Elastic Stack Logstash
1

New RHEL 9 box

trying to get logstash to listen on 514 but it fails out

[2024-08-01T10:45:37,012][ERROR][logstash.javapipeline    ][main][input-tcp-514] A plugin had an unrecoverable error. Will restart this plugin.
  Pipeline_id:main
  Plugin: <LogStash::Inputs::Tcp id=>"input-tcp-514", type=>"syslog", port=>514, tags=>["tcp/514"], enable_metric=>true, codec=><LogStash::Codecs::Line id=>"line_40339019-484a-45e2-a57e-1c9c2a7ee911", enable_metric=>true, charset=>"UTF-8", delimiter=>"\n">, host=>"0.0.0.0", mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_enabled=>false, ssl_client_authentication=>"required", ssl_verify=>true, ssl_verification_mode=>"full", ssl_key_passphrase=><password>, tcp_keep_alive=>false, dns_reverse_lookup_enabled=>true>
  Error: event executor terminated
  Exception: Java::JavaUtilConcurrent::RejectedExecutionException
  Stack: io.netty.util.concurrent.SingleThreadEventExecutor.reject(SingleThreadEventExecutor.java:934)
io.netty.util.concurrent.SingleThreadEventExecutor.offerTask(SingleThreadEventExecutor.java:351)
io.netty.util.concurrent.SingleThreadEventExecutor.addTask(SingleThreadEventExecutor.java:344)
io.netty.util.concurrent.SingleThreadEventExecutor.execute(SingleThreadEventExecutor.java:836)
io.netty.util.concurrent.SingleThreadEventExecutor.execute0(SingleThreadEventExecutor.java:827)
io.netty.util.concurrent.SingleThreadEventExecutor.execute(SingleThreadEventExecutor.java:817)
io.netty.channel.AbstractChannel$AbstractUnsafe.register(AbstractChannel.java:483)
io.netty.channel.SingleThreadEventLoop.register(SingleThreadEventLoop.java:89)
io.netty.channel.SingleThreadEventLoop.register(SingleThreadEventLoop.java:83)
io.netty.channel.MultithreadEventLoopGroup.register(MultithreadEventLoopGroup.java:86)
io.netty.bootstrap.AbstractBootstrap.initAndRegister(AbstractBootstrap.java:339)
io.netty.bootstrap.AbstractBootstrap.doBind(AbstractBootstrap.java:288)
io.netty.bootstrap.AbstractBootstrap.bind(AbstractBootstrap.java:284)
io.netty.bootstrap.AbstractBootstrap.bind(AbstractBootstrap.java:269)
org.logstash.tcp.InputLoop.run(InputLoop.java:86)
usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_input_minus_tcp_minus_6_dot_4_dot_2_minus_java.lib.logstash.inputs.tcp.RUBY$method$run$0(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-input-tcp-6.4.2-java/lib/logstash/inputs/tcp.rb:192)
org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:165)
org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:185)
org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:220)
org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:242)
org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:314)
org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)
org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:82)
org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:201)
org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:188)
org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:220)
org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:466)
org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:244)
org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:314)
org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)
org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:118)
org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)
org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)
org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)
org.jruby.runtime.Block.call(Block.java:144)
org.jruby.RubyProc.call(RubyProc.java:354)
org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)
java.base/java.lang.Thread.run(Thread.java:840)
2

Is there a more specific exception logged, such as "access denied"?

3

How are you running logstash? As a service? On the command line?

4

its as a service

5

No thats the only error, but when i take port 514 out of the Input Conf file it is fine.

Its not allowing binding to 514 for some reason

7

Your operating system may consider 514 to be a "privileged port" -- you need special privileges to open a port below 1024.

Depending on your OS and personal tastes the solution might be setcap(8), authbind, a kernel level port forwarder or something else. Running logstash as root might work, but would be a terrible solution.

8

Thanks! yeah running it from binary works which verifies it is a reserved port , i will have things forwarded from 514