# Logstash "UDP listener died" with exception: Unable to establish loopback connection

**URL:** <https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308>\
**Category:** Logstash\
**Created:** [August 5, 2016, 6:52am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308 "2016-08-05T06:52:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\
**Post date:** [August 5, 2016, 6:52am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/1 "2016-08-05T06:52:37Z")

</div>

Hi,

I configured logstash version 2.1.1 to receive logs on UDP port.  
After running successfully few hours following exception shown in  
diagnostic log

{:timestamp=\>"2016-07-26T18:30:10.976000+0530",  
:message=\>"Received an event that has a different character encoding  
than you configured.", :text=\>"\<49\>%ASA-1-105048: (unit)  
Mate\x92s service module (application) is different from mine  
(application)\n", :expected\_charset=\>"UTF-8", :level=\>:warn}  
{:timestamp=\>"2016-07-26T21:03:42.910000+0530",  
:message=\>"UDP listener died", :exception=\>#,  
:backtrace=\>["org/jruby/RubyIO.java:3682:in select'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp\_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:in  
run'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:in  
start\_input'"], :level=\>:warn}  
{:timestamp=\>"2016-07-26T21:04:21.905000+0530",  
:message=\>"UDP listener died", :exception=\>#\<IOError: Unable  
to establish loopback connection\>,  
:backtrace=\>["org/jruby/RubyIO.java:3682:inselect'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp\_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:inrun'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:instart\_input'"], :level=\>:warn}  
{:timestamp=\>"2016-07-27T12:01:34.151000+0530",  
:message=\>"UDP listener died", :exception=\>#,  
:backtrace=\>["org/jruby/RubyIO.java:3682:in select'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp\_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:in  
run'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:in  
start\_input'"], :level=\>:warn}  
{:timestamp=\>"2016-07-27T12:01:59.161000+0530",  
:message=\>"UDP listener died", :exception=\>#\<IOError: Unable  
to establish loopback connection\>,  
:backtrace=\>["org/jruby/RubyIO.java:3682:inselect'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:77:inudp\_listener'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:50:inrun'", "C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:206:ininputworker'",

"C:/SVDataCollector/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.1-java/lib/logstash/pipeline.rb:199:instart\_input'"], :level=\>:warn}

Please let me know the reasons/suggestions to fix the issue.

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 5, 2016, 7:03am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/2 "2016-08-05T07:03:18Z")

</div>

> [@venkaty](#):
>
> Received an event that has a different character encoding than you configured

Is why.

Providing your config would be helpful.

---

<div class="post-metadata">

**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\
**Post date:** [August 5, 2016, 7:49am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/3 "2016-08-05T07:49:53Z")

</div>

Thanks Mark for quick reply.

logstash conf for input

input {

```
tcp
{
    port => 514 #logstash receives the events on TCP port 514.
    type => syslog
}

udp
{
    port => 514 #logstash receives the events on UDP port 514.
    type => syslog
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

udp
{
    port => 9991 #logstash receives the netflow events on UDP port 9991
    codec => netflow
    type => flow
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

udp
{
    port => 515
    type => syslogng
    workers => 4
    queue_size => 15000
    buffer_size => 1024
}

```

}

---

<div class="post-metadata">

**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\
**Post date:** [August 5, 2016, 7:52am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/4 "2016-08-05T07:52:19Z")

</div>

i am using logstash version 2.1.1

---

<div class="post-metadata">

**Author:** ![venkaty](https://avatars.discourse-cdn.com/v4/letter/v/919ad9/32.png) [@venkaty](https://discuss.elastic.co/u/venkaty)\
**Post date:** [August 24, 2016, 6:15am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/5 "2016-08-24T06:15:05Z")

</div>

Anyone with the idea please?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died-with-exception-unable-to-establish-loopback-connection/57308/6 "2017-07-06T04:41:56Z")

</div>