# Logstash UDP listener died

**URL:** <https://discuss.elastic.co/t/logstash-udp-listener-died/97843>\
**Category:** Logstash\
**Created:** [August 22, 2017, 3:54am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843 "2017-08-22T03:54:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 22, 2017, 3:54am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843/1 "2017-08-22T03:54:44Z")

</div>

Hi everyone,  
I am trying to receive fortigate syslog from port 514, but there are some errors  
here's my configure:  
input {  
tcp {  
port =\> 514  
type =\> syslog  
}  
udp {  
port =\> 514  
type =\> syslog  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}  
output log:  
[2017-08-22T11:39:12,057][INFO][logstash.inputs.udp] Starting UDP listene  
r {:address=\>"0.0.0.0:514"}  
[2017-08-22T11:39:12,057][WARN][logstash.inputs.udp] UDP listener died {:  
exception=\>#\<Errno::EADDRINUSE: Address already in use - bind - Address already  
in use: bind\>, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:161:in `bin d'", "E:/ELK/logstash-5.5.2/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1. 1/lib/logstash/inputs/udp.rb:82:in`udp\_listener'", "E:/ELK/logstash-5.5.2/vendo  
r/bundle/jruby/1.9/gems/logstash-input-udp-3.1.1/lib/logstash/inputs/udp.rb:56:i  
n `run'", "E:/ELK/logstash-5.5.2/logstash-core/lib/logstash/pipeline.rb:456:in`  
inputworker'", "E:/ELK/logstash-5.5.2/logstash-core/lib/logstash/pipeline.rb:449  
:in `start\_input'"]}

thank you in advance : O

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [August 22, 2017, 6:34am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843/2 "2017-08-22T06:34:33Z")

</div>

> [@f26227279](#):
>
> #\<Errno::EADDRINUSE: Address already in use - bind - Address already
> 
> in use: bind\>

This message means that some other process is already listening in UDP Port 514. Probably system's syslog server.

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 22, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843/3 "2017-08-22T11:37:57Z")

</div>

Thank you : )  
the problem is solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2017, 11:38am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843/4 "2017-09-19T11:38:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.