Multiple Filebeat prospectors, one filebeat instance, multiple logstash .conf files

Elastic Stack Logstash
1

Hello Everyone,

I have been using filebeat in conjunction with Logstash for some time.

Up untill recently i had no issue with using multiple
input {
beats {
port=5044
}
}
statements in separate logstash config files.

I do have issues now as i get the following error :
Pipeline_id:main
** Plugin: <LogStash::Inputs::Beats port=>5044, id=>"7ab6bbf2ae40483122f5367cfe92980c97ad48ae1de5cb9390fdf3ee742a3235", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_68efe83f-c5f9-4405-8028-0c24b847b51e", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60, executor_threads=>2>**
** Error: Address already in use**
** Exception: Java::JavaNet::BindException**

This goes away if i only use one beats input at port 5044. (one configuration file)

As we have multiple web servers hosted on the same machine I only need one filebeat instance with multiple prospectors defined per host.

But I do need separate logstash configuration files for various reasons. (deployment methods currently in place)

Up untill now I could separate incomming events based on tags supplied by filebeat (if statements in LS conf file) and use multiple configuration files all declaring a beats input at port 5044.

Is this a breaking change since LS 6.3?

Please advise, and thanks for the wonderfull ELK stack :slight_smile:

2

Up untill recently i had no issue with using multiple
input {
beats {
port=5044
}
}
statements in separate logstash config files.

In a single Logstash pipeline? Really? I find that hard to believe.

But I do need separate logstash configuration files for various reasons. (deployment methods currently in place)

How you split your Logstash configurations into files doesn't matter as long as you don't have more than one listener per port.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.