Logstash restart error?

clifford · February 22, 2016, 2:33am

My environment is logstash and elasticsearch with a single server.
Last week I try to modify the logstash config file,configtest result is ok, and then restart the logstash service.But an error restart service results:{:timestamp=>"2016-02-22T10:15:26.502000+0800", :message=>"The error reported is: \n Address already in use - bind - Address already in use"}

I try to find the port 5044 and then kill off, but the lsof - I: 5044 result is empty.Netstat lanp | grep logstash as well.

I don't know what is the problem?!!!

James_Tang · February 22, 2016, 2:47am

There are 2 service here which is different and separate. Logstash and ElasticSearch.
Logstash do not explicitly bind to a port. ElasticSearch does. If Both are down when u are restarting it then the issue should lie elsewhere.

Check the input section of the logstash config and see if any inputs is listening for input and then check it against the service of the machine it is running on. Perhaps that is causing the port in use error.

James_Tang · February 22, 2016, 2:49am

BTW they should be started seperately. With priority given to ES. First Up, Last down.

clifford · February 22, 2016, 7:30am

thanks . i'am solved it. that's you say input section lessenning beats 5044 port 。