Netflow and Filebeat - Error running harvester: listen udp 0.0.0.0:2055: bind: address already in use

I'm trying to configure the netflow module with Filebeat but getting an error about the local address already in use. In my config, if I change the netflow_host to localhost instead of 0.0.0.0 then the error says 127.0.0.1 instead of 0.0.0.0. When I run lsof -i | grep 2055, I see the filebeat process opening that port but not LISTENING (output below). If I change the port in the \modules.d\netflow.yaml to something else then I still get this error but with the new port.

filebeat  4611            root   11u  IPv4  57181      0t0  UDP localhost.localdomain:2055 

If I stop the filebeat service and re-run that command, I don't get any results for port 2055. This seems to be normal behavior other than it not listening so I'm not sure why I'm getting this error. Any ideas?

To update my question, I ended up just reinstalling Filebeat and it bound to the correct port now. Not sure what happened originally but not getting that error anymore.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.