# Logstash - too many loopback tcp connections in time\_wait state **URL:** \ **Category:** Logstash\ **Created:** [August 5, 2016, 6:58am UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309 "2016-08-05T06:58:11Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Post date:** [August 5, 2016, 6:58am UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309/1 "2016-08-05T06:58:12Z")
Hi, Too many loopback connections in time\_wait state when logstash started from windows console. TCP 127.0.0.1:61227 HYD-ARCH-08:61228 TIME\_WAIT 0 TCP 127.0.0.1:61234 HYD-ARCH-08:61235 TIME\_WAIT 0 TCP 127.0.0.1:61243 HYD-ARCH-08:61244 TIME\_WAIT 0 TCP 127.0.0.1:61249 HYD-ARCH-08:61250 TIME\_WAIT 0 TCP 127.0.0.1:61259 HYD-ARCH-08:61260 TIME\_WAIT 0 TCP 127.0.0.1:61267 HYD-ARCH-08:61268 TIME\_WAIT 0 TCP 127.0.0.1:61277 HYD-ARCH-08:61278 TIME\_WAIT 0 TCP 127.0.0.1:61287 HYD-ARCH-08:61288 TIME\_WAIT 0 TCP 127.0.0.1:61293 HYD-ARCH-08:61294 TIME\_WAIT 0 TCP 127.0.0.1:61301 HYD-ARCH-08:61302 TIME\_WAIT 0 TCP 127.0.0.1:61310 HYD-ARCH-08:61311 TIME\_WAIT 0 TCP 127.0.0.1:61317 HYD-ARCH-08:61318 TIME\_WAIT 0 TCP 127.0.0.1:61325 HYD-ARCH-08:61326 TIME\_WAIT 0 TCP 127.0.0.1:61335 HYD-ARCH-08:61336 TIME\_WAIT 0 TCP 127.0.0.1:61342 HYD-ARCH-08:61343 TIME\_WAIT 0 TCP 127.0.0.1:61348 HYD-ARCH-08:61349 TIME\_WAIT 0 TCP 127.0.0.1:61361 HYD-ARCH-08:61362 TIME\_WAIT 0 TCP 127.0.0.1:61370 HYD-ARCH-08:61371 TIME\_WAIT 0 TCP 127.0.0.1:61380 HYD-ARCH-08:61381 TIME\_WAIT 0 TCP 127.0.0.1:61386 HYD-ARCH-08:61387 TIME\_WAIT 0 TCP 127.0.0.1:61394 HYD-ARCH-08:61395 TIME\_WAIT 0 TCP 127.0.0.1:61396 HYD-ARCH-08:61398 TIME\_WAIT 0 TCP 127.0.0.1:61397 HYD-ARCH-08:61399 TIME\_WAIT 0 TCP 127.0.0.1:61400 HYD-ARCH-08:61401 TIME\_WAIT 0 TCP 127.0.0.1:61407 HYD-ARCH-08:61408 TIME\_WAIT 0 Please let me know the reasons. Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 5, 2016, 7:03am UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309/2 "2016-08-05T07:03:57Z")
Unless you can provide more information it's unlikely we can help. Please read [https://www.elastic.co/help](https://www.elastic.co/help) ---
**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Post date:** [August 5, 2016, 7:46am UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309/3 "2016-08-05T07:46:23Z")
logstash version 2.3.4 logstash conf content input { ``` udp { port => 9991 #logstash receives the netflow events on UDP port 9991 codec => netflow type => flow workers => 4 queue_size => 15000 buffer_size => 1024 } ``` } filter { if [type] == "syslog" { grok { ``` } syslog_pri { } } mutate { rename => { "host" => "ip_address" } } metrics { flush_interval => 1200 clear_interval => 1200 add_tag => "metric" meter => ["events"] } if "metric" in [tags] { ruby { code => "event['currenttime'] = event.timestamp.time.localtime.strftime('%d/%m/%Y %H:%M:%S')" } } ``` } output { ``` if "metric" in [tags] { file { flush_interval => 0 path => "e://logstashstats-%{+YYYY-MM-dd}.log" } } ``` } Please let me know the any specific information required ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 8, 2016, 3:47pm UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309/4 "2016-08-08T15:47:34Z")
It's not clear to me that these connections are related to Logstash at all. Have you tried sniffing the traffic sent over those connections (if any) to get clues? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309/5 "2017-07-06T04:44:21Z")