# Logtash is not accepting/recieving syslog sent by linux server
**URL:** https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333
**Category:** Logstash
**Created:** [November 17, 2016, 6:49am UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333 "2016-11-17T06:49:27Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 6:49am UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/1 "2016-11-17T06:49:27Z")
I have configure syslogng to sent syslog to server1 and port 514. but the logtash installed on server1 is not recieving the syslogs on port 514.
i have defined input also for the port 514. Pls assist
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 8:31am UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/2 "2016-11-17T08:31:34Z")
@magnusbaeck
I have logtash on server1 and syslog-ng on server 2. I have configured syslogng conf to send logs to server1 on port 514. tcp
but how do i check whether the logtash on server1 is receiving those logs. in my case it seems it is not receiving . i tried with blank input also . can you let em know hat exactly i am misisng here.
---
### Author:  [@DimitrisFilippou](https://discuss.elastic.co/u/DimitrisFilippou)
#### Post date: [November 17, 2016, 8:57am UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/3 "2016-11-17T08:57:37Z")
Check if logstash is running with this command
`sudo systemctl status logstash.service`
If its not running activate it with
`sudo systemctl start logstash.service`
You didn't specify your exact error so i'm assuming you have correctly set-up the servers.
If the servers are on the same network and have an active internet connection they should work.
In addition make sure your configurations are correct because you know... Yaml is sensitive
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 8:59am UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/4 "2016-11-17T08:59:20Z")
> [@DimitrisFilippou](#):
>
> Yaml is sensitive
Thanks one more information, my logtash is running on Windows and syslogng is on linux.
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 4:12pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/5 "2016-11-17T16:12:04Z")
pls find logtash log:
[2016-11-18T00:03:55,472][INFO][logstash.inputs.tcp] Starting tcp input listener {:address=\>"0.0.0.0:2514"}
[2016-11-18T00:03:55,642][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"0.0.0.0:2515"}
[2016-11-18T00:03:56,115][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>["[http://localhost:9200](http://localhost:9200)"]}}
[2016-11-18T00:03:56,115][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}
[2016-11-18T00:03:56,971][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}
[2016-11-18T00:03:57,001][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["localhost:9200"]}
[2016-11-18T00:03:57,031][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}
[2016-11-18T00:03:57,046][INFO][logstash.pipeline] Pipeline main started
[2016-11-18T00:03:57,285][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 4:14pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/6 "2016-11-17T16:14:45Z")
Pls find elastic log 🙂
[2016-11-17T20:50:45,474][INFO][o.e.n.Node] [sgtummpre815] initializing ...
[2016-11-17T20:50:45,900][INFO][o.e.e.NodeEnvironment] [sgtummpre815] using [1] data paths, mounts [[OSDisk (C:)]], net usable\_space [140.3gb], net total\_space [465.2gb], spins? [unknown], types [NTFS]
[2016-11-17T20:50:45,900][INFO][o.e.e.NodeEnvironment] [sgtummpre815] heap size [1.9gb], compressed ordinary object pointers [true]
[2016-11-17T20:50:46,025][INFO][o.e.n.Node] [sgtummpre815] version[5.0.0], pid[12900], build[253032b/2016-10-26T04:37:51.531Z], OS[Windows 7/6.1/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0\_111/25.111-b14]
[2016-11-17T20:50:48,611][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [aggs-matrix-stats]
[2016-11-17T20:50:48,611][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [ingest-common]
[2016-11-17T20:50:48,611][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [lang-expression]
[2016-11-17T20:50:48,611][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [lang-groovy]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [lang-mustache]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [lang-painless]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [percolator]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [reindex]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [transport-netty3]
[2016-11-17T20:50:48,627][INFO][o.e.p.PluginsService] [sgtummpre815] loaded module [transport-netty4]
[2016-11-17T20:50:48,643][INFO][o.e.p.PluginsService] [sgtummpre815] no plugins loaded
[2016-11-17T20:50:55,289][INFO][o.e.n.Node] [sgtummpre815] initialized
[2016-11-17T20:50:55,289][INFO][o.e.n.Node] [sgtummpre815] starting ...
[2016-11-17T20:51:04,957][INFO][o.e.t.TransportService] [sgtummpre815] publish\_address {127.0.0.1:9300}, bound\_addresses {127.0.0.1:9300}, {[::1]:9300}
[2016-11-17T20:51:09,174][INFO][o.e.c.s.ClusterService] [sgtummpre815] new\_master {sgtummpre815}{pFO\_sShuR8S5UnQ9UV\_pCg}{l8f2VfTUTAmI-JuQJ8CBLA}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)
[2016-11-17T20:51:10,197][INFO][o.e.g.GatewayService] [sgtummpre815] recovered [1] indices into cluster\_state
[2016-11-17T20:51:11,169][INFO][o.e.c.r.a.AllocationService] [sgtummpre815] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.kibana][0]] ...]).
[2016-11-17T20:51:15,269][INFO][o.e.h.HttpServer] [sgtummpre815] publish\_address {127.0.0.1:9200}, bound\_addresses {127.0.0.1:9200}, {[::1]:9200}
[2016-11-17T20:51:15,272][INFO][o.e.n.Node] [sgtummpre815] started
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 4:16pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/7 "2016-11-17T16:16:15Z")
pls find kibana log:
C:\Elastic\kibana-5.0.0-windows-x86\kibana-5.0.0-windows-x86\bin\>kibana.bat
log [16:02:49.699] [info][status][plugin:kibana@5.0.0] Status changed from uninitialized to green - Ready
log [16:02:49.839] [info][status][plugin:elasticsearch@5.0.0] Status changed from uninitialized to yellow - Waiting for Elasticsearch
log [16:02:49.899] [info][status][plugin:console@5.0.0] Status changed from uninitialized to green - Ready
log [16:02:55.153] [error][status][plugin:elasticsearch@5.0.0] Status changed from yellow to red - Request Timeout after 3000ms
log [16:02:55.163] [info][status][plugin:timelion@5.0.0] Status changed from uninitialized to green - Ready
log [16:02:55.183] [info][listening] Server running at [http://localhost:5601](http://localhost:5601)
log [16:02:55.193] [error][status][ui settings] Status changed from uninitialized to red - Elasticsearch plugin is red
log [16:02:57.748] [info][status][plugin:elasticsearch@5.0.0] Status changed from red to green - Kibana index ready
log [16:02:57.758] [info][status][ui settings] Status changed from red to green - Ready
---
### Author:  [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)
#### Post date: [November 17, 2016, 5:13pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/8 "2016-11-17T17:13:38Z")
> [@vivekcts](#):
>
> [2016-11-18T00:03:55,472][INFO][logstash.inputs.tcp] Starting tcp input listener {:address=\>"0.0.0.0:2514"}
> [2016-11-18T00:03:55,642][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"0.0.0.0:2515"}
You are listening on port 2514 (TCP) and 2515 (UDP), not 514.
You can double checkt your listeners by typing the following in your shell:
> [@](#):
>
> netstat -an | grep 514
The output should display that you are listening on what protocols/ports that match 514
---
### Author:  [@vivekcts](https://discuss.elastic.co/u/vivekcts)
#### Post date: [November 17, 2016, 5:26pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/9 "2016-11-17T17:26:12Z")
Yes i am listening to 2514 and syslog also sending to 2514 .
I just changed the port on both end to see may be old 514 is being used by
some other application so changed the port on sender and reciever side.
---
### Author:  [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)
#### Post date: [November 17, 2016, 5:30pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/10 "2016-11-17T17:30:08Z")
Are you able to telnet to the port from the syslog machine to the logstash server to test connectivity?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 15, 2016, 5:30pm UTC](https://discuss.elastic.co/t/logtash-is-not-accepting-recieving-syslog-sent-by-linux-server/66333/11 "2016-12-15T17:30:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.