Logstash Syslog,UDP listener died

Elastic Stack Logstash
1

elasticsearch=1.6
logstash=1.5

Im using docker with supervisord to start up the ELK stack. I tried using ort 514 and port 5009 to listen on the syslog messages coming in but when i run logstash in debug mode i get the follwoing error syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:5009", :exception=>#<Errno::EADDRINUSE: Address already in use - bind - Address already in use> or syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:5009", :exception=>#<Errno::EADDRINUSE: Address already in use - bind - not found > .

Config is
input {
syslog {
type => "syslog"
port => 5009

    }

}

2

UDP listener died {:exception=>SocketError: bind: name or service not known this is the UDP error i recieve.

3

port is open also. pid 8 is connected with logstash. Can't see, to figure out why this will not work. Any suggestions would be great please!
lsof -nPi :5514
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 8 root 90u IPv6 0t0 UDP *:5514

4

issue is fixed.

5

What was the problem?

6

I had to open a different port inside and out. Even with logstash starting with root it didnt like the port I had open.

1 Like