Netflow and Filebeat - Error running harvester: listen udp 0.0.0.0:2055: bind: address already in use

Elastic Stack Beats
,
1

I'm trying to configure the netflow module with Filebeat but getting an error about the local address already in use. In my config, if I change the netflow_host to localhost instead of 0.0.0.0 then the error says 127.0.0.1 instead of 0.0.0.0. When I run lsof -i | grep 2055, I see the filebeat process opening that port but not LISTENING (output below). If I change the port in the \modules.d\netflow.yaml to something else then I still get this error but with the new port.

filebeat  4611            root   11u  IPv4  57181      0t0  UDP localhost.localdomain:2055

If I stop the filebeat service and re-run that command, I don't get any results for port 2055. This seems to be normal behavior other than it not listening so I'm not sure why I'm getting this error. Any ideas?

2

To update my question, I ended up just reinstalling Filebeat and it bound to the correct port now. Not sure what happened originally but not getting that error anymore.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.