Logstash "UDP listener died" with exception: Unable to establish loopback connection

Elastic Stack Logstash
1

Hi,

I configured logstash version 2.1.1 to receive logs on UDP port.
After running successfully few hours following exception shown in
diagnostic log

{:timestamp=>"2016-07-26T18:30:10.976000+0530",
:message=>"Received an event that has a different character encoding
than you configured.", :text=>"<49>%ASA-1-105048: (unit)
Mate\x92s service module (application) is different from mine
(application)\n", :expected_charset=>"UTF-8", :level=>:warn}
{:timestamp=>"2016-07-26T21:03:42.910000+0530",
:message=>"UDP listener died", :exception=>#,
:backtrace=>["org/jruby/RubyIO.java:3682:in select'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:in
run'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:in
start_input'"], :level=>:warn}
{:timestamp=>"2016-07-26T21:04:21.905000+0530",
:message=>"UDP listener died", :exception=>#<IOError: Unable
to establish loopback connection>,
:backtrace=>["org/jruby/RubyIO.java:3682:inselect'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:inrun'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:instart_input'"], :level=>:warn}
{:timestamp=>"2016-07-27T12:01:34.151000+0530",
:message=>"UDP listener died", :exception=>#,
:backtrace=>["org/jruby/RubyIO.java:3682:in select'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:in
run'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:in
start_input'"], :level=>:warn}
{:timestamp=>"2016-07-27T12:01:59.161000+0530",
:message=>"UDP listener died", :exception=>#<IOError: Unable
to establish loopback connection>,
:backtrace=>["org/jruby/RubyIO.java:3682:inselect'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:inrun'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:instart_input'"], :level=>:warn}

Please let me know the reasons/suggestions to fix the issue.

Thanks.

2

Is why.

Providing your config would be helpful.

3

Thanks Mark for quick reply.

logstash conf for input

input {

tcp
{
    port => 514    #logstash receives the events on TCP port 514.
    type => syslog
}

udp
{
    port => 514    #logstash receives the events on UDP port 514.
    type => syslog
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

udp
{
    port => 9991    #logstash receives the netflow events on UDP port 9991
    codec => netflow
    type => flow
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

udp
{
    port => 515
    type => syslogng
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

}

4

i am using logstash version 2.1.1

5

Anyone with the idea please?

Thanks!