Lumberjack input not working with beats input

Elastic Stack Beats
1

Hii I was using lumberjack input to receive logs from Logstash Forwarder . Then I also used Filebeat and liked some of its properties . Now I have one server that sends logs to Logstash using Filebeat and another server that sends logs to Logstash using Logstash Forwarder. So my input section looks something like this-

input {
beats {
port => 5000
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"

    }
    lumberjack {
            codec => multiline {
                           pattern => "^\["
                            what => "previous"
                            negate => true
           }
            port => 5000
            ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
            ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    }

}

But my logstash could not start . It says -

Default settings used: Filter workers: 2
The error reported is:
Address already in use - bind - Address already in use

If I use either only Filebeat or lumberjack things work fine . I need the two to work . How can i achieve the same ?????

2

You can not have 2 TCP based inputs listening on the same port. You need to assign one of your inputs to a different port.

1 Like
3

Each of those inputs requires its own port. They both cannot be bound to port 5000. Change one of them to a different port.

4

thanx guys correct explanation