Logstash - too many loopback tcp connections in time_wait state

Elastic Stack Logstash
1

Hi,

Too many loopback connections in time_wait state when logstash started from windows console.

TCP 127.0.0.1:61227 HYD-ARCH-08:61228 TIME_WAIT 0
TCP 127.0.0.1:61234 HYD-ARCH-08:61235 TIME_WAIT 0
TCP 127.0.0.1:61243 HYD-ARCH-08:61244 TIME_WAIT 0
TCP 127.0.0.1:61249 HYD-ARCH-08:61250 TIME_WAIT 0
TCP 127.0.0.1:61259 HYD-ARCH-08:61260 TIME_WAIT 0
TCP 127.0.0.1:61267 HYD-ARCH-08:61268 TIME_WAIT 0
TCP 127.0.0.1:61277 HYD-ARCH-08:61278 TIME_WAIT 0
TCP 127.0.0.1:61287 HYD-ARCH-08:61288 TIME_WAIT 0
TCP 127.0.0.1:61293 HYD-ARCH-08:61294 TIME_WAIT 0
TCP 127.0.0.1:61301 HYD-ARCH-08:61302 TIME_WAIT 0
TCP 127.0.0.1:61310 HYD-ARCH-08:61311 TIME_WAIT 0
TCP 127.0.0.1:61317 HYD-ARCH-08:61318 TIME_WAIT 0
TCP 127.0.0.1:61325 HYD-ARCH-08:61326 TIME_WAIT 0
TCP 127.0.0.1:61335 HYD-ARCH-08:61336 TIME_WAIT 0
TCP 127.0.0.1:61342 HYD-ARCH-08:61343 TIME_WAIT 0
TCP 127.0.0.1:61348 HYD-ARCH-08:61349 TIME_WAIT 0
TCP 127.0.0.1:61361 HYD-ARCH-08:61362 TIME_WAIT 0
TCP 127.0.0.1:61370 HYD-ARCH-08:61371 TIME_WAIT 0
TCP 127.0.0.1:61380 HYD-ARCH-08:61381 TIME_WAIT 0
TCP 127.0.0.1:61386 HYD-ARCH-08:61387 TIME_WAIT 0
TCP 127.0.0.1:61394 HYD-ARCH-08:61395 TIME_WAIT 0
TCP 127.0.0.1:61396 HYD-ARCH-08:61398 TIME_WAIT 0
TCP 127.0.0.1:61397 HYD-ARCH-08:61399 TIME_WAIT 0
TCP 127.0.0.1:61400 HYD-ARCH-08:61401 TIME_WAIT 0
TCP 127.0.0.1:61407 HYD-ARCH-08:61408 TIME_WAIT 0

Please let me know the reasons.

Thanks

2

Unless you can provide more information it's unlikely we can help.

Please read https://www.elastic.co/help

3

logstash version 2.3.4

logstash conf content

input {

udp
{
    port => 9991    #logstash receives the netflow events on UDP port 9991
    codec => netflow
    type => flow
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

}

filter {
if [type] == "syslog" {
grok {

    }

    syslog_pri {
        
    }

 }
mutate {

    rename => { "host" => "ip_address" }


}

metrics {
    flush_interval => 1200
    clear_interval => 1200
    add_tag => "metric"
    meter => [ "events" ]
}

if "metric" in [tags] {
    ruby {
        code => "event['currenttime'] = event.timestamp.time.localtime.strftime('%d/%m/%Y %H:%M:%S')"
    }
}

}

output {

if "metric" in [tags] {
    file {
        flush_interval => 0
        path => "e://logstashstats-%{+YYYY-MM-dd}.log"
    }
    
}

}

Please let me know the any specific information required ?

4

It's not clear to me that these connections are related to Logstash at all. Have you tried sniffing the traffic sent over those connections (if any) to get clues?