# Logstash - port closed **URL:** \ **Category:** Logstash\ **Created:** [November 30, 2017, 2:41pm UTC](https://discuss.elastic.co/t/logstash-port-closed/109774 "2017-11-30T14:41:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\ **Post date:** [November 30, 2017, 2:41pm UTC](https://discuss.elastic.co/t/logstash-port-closed/109774/1 "2017-11-30T14:41:22Z")
Hi, I have problem with logstash - service is running, but port 10515 isnt open ☹ Here is my logstash.conf: input { udp { host =\> "192.168.201.30" port =\> 10514 codec =\> "json" type =\> "rsyslog" } } filter { } output { if [type] == "rsyslog" { elasticsearch { hosts =\> ["192.168.201.30:9200"] } } } Error from log: [2017-11-30T15:33:01,581][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, =\> at line 42, column 5 (byte 903) after input {\ntcp {\nport =\> 514\ntype =\> syslog\n}\nudp {\ntype =\> syslog\nport =\> 514$ Where is problem? Thanks ---
**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Post date:** [December 1, 2017, 4:04pm UTC](https://discuss.elastic.co/t/logstash-port-closed/109774/2 "2017-12-01T16:04:00Z")
I'm a noob at Logstash, but I'll take a shot: could you try putting quotation marks around the port number? I've noticed some of the Logstash docs specify it as a number ([https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html](https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html)) and others as a string ([https://www.elastic.co/guide/en/logstash/6.0/advanced-pipeline.html](https://www.elastic.co/guide/en/logstash/6.0/advanced-pipeline.html)), at least when using beats. Not sure why, specifically, but I feel like it would be better if they standardized it as a number and then converted it to a string somewhere else if they need to. Edit: Are you saying the port isn't actually open at all? If it isn't, I think that's something you'd have to configure on your system itself. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2017, 6:43am UTC](https://discuss.elastic.co/t/logstash-port-closed/109774/3 "2017-12-05T06:43:19Z")
Acccording to the error message Logstash is trying to load a configuration file containing "port =\> 514". That's not the configuration you posted. Does that come from an extra config file in /etc/logstash/conf.d? ---
**Author:** ![Tade](https://avatars.discourse-cdn.com/v4/letter/t/f4b2a3/32.png) [@Tade](https://discuss.elastic.co/u/Tade)\ **Post date:** [December 5, 2017, 7:33am UTC](https://discuss.elastic.co/t/logstash-port-closed/109774/4 "2017-12-05T07:33:36Z")
Thansk for help. In conf.d i have only logstash.conf. after apt-get upgrade logstash is service ok: [2017-12-04T16:23:55,521][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://192.168.201.30:9200/](http://192.168.201.30:9200/), :path=\>"/"} [2017-12-04T16:23:55,626][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://192.168.201.30:9200/](http://192.168.201.30:9200/)"} [2017-12-04T16:23:55,685][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2017-12-04T16:23:55,692][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-\*", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"_default_"=\>{"\_a$ [2017-12-04T16:23:55,699][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//192.168.201.30:9200](https://192.168.201.30:9200)"]} [2017-12-04T16:23:55,701][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250} [2017-12-04T16:23:56,384][INFO][logstash.pipeline] Pipeline main started [2017-12-04T16:23:56,416][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"192.168.201.30:10514"} [2017-12-04T16:23:56,439][INFO][logstash.inputs.udp] UDP listener started {:address=\>"192.168.201.30:10514", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"} [2017-12-04T16:23:56,488][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 2, 2018, 7:34am UTC](https://discuss.elastic.co/t/logstash-port-closed/109774/5 "2018-01-02T07:34:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.