# Not able to process UDP traffic

**URL:** <https://discuss.elastic.co/t/not-able-to-process-udp-traffic/252838>\
**Category:** Logstash\
**Created:** [October 21, 2020, 12:31pm UTC](https://discuss.elastic.co/t/not-able-to-process-udp-traffic/252838 "2020-10-21T12:31:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joao.matias](https://avatars.discourse-cdn.com/v4/letter/j/f14d63/32.png) [@joao.matias](https://discuss.elastic.co/u/joao.matias)\
**Post date:** [October 21, 2020, 12:31pm UTC](https://discuss.elastic.co/t/not-able-to-process-udp-traffic/252838/1 "2020-10-21T12:31:35Z")

</div>

Hello everyone.

I have a host with the following specs

- CentOS 7
- 16GB RAM
- 2 CPUs
- 100GB storage
- 2 network interfaces

And I'm trying to set up logstash to receive and filter the following types of logs

- Netflow over UDP on port 2055
- Syslog over UDP on port 514

My goal, at this point, is just to receive the logs, filter, and forward them to a file (only for testing).  
My issue is that I can see the logs arriving at the host

```auto
[root@specialhost specialuser]# tcpdump -i any udp port 2055 and dst host <MYIP>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
11:54:48.356883 IP <SOMEOTHERIP>.dossier > <MYIP>.iop: UDP, length 1312
11:54:48.416922 IP <SOMEOTHERIP>.dossier > <MYIP>.iop: UDP, length 1312
11:54:48.446942 IP <SOMEOTHERIP>.dossier > <MYIP>.iop: UDP, length 1312
11:54:48.546944 IP <SOMEOTHERIP>.dossier > <MYIP>.iop: UDP, length 1312

```

But I can't see them going through logstash

```auto
[2020-10-21T12:03:30,740][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 25.262-b10 on 1.8.0_262-b10 +indy +jit [linux-x86_64]"}
[2020-10-21T12:03:34,864][INFO][org.reflections.Reflections] Reflections took 112 ms to scan 1 urls, producing 22 keys and 45 values 
[2020-10-21T12:03:39,303][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, "pipeline.sources"=>["/etc/logstash/conf.d/logstash-101-input-checkpoint.conf", "/etc/logstash/conf.d/logstash-999-output.conf"], :thread=>"#<Thread:0x7e80790b run>"}
[2020-10-21T12:03:40,302][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.96}
[2020-10-21T12:03:40,336][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}
[2020-10-21T12:03:40,412][INFO][logstash.inputs.udp][main][2d7a6d4cd7d2f4c7d12304be6f50e980c427cff2a74ff952e4d15f627639d192] Starting UDP listener {:address=>"<MYIP>:2055"}
[2020-10-21T12:03:40,490][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2020-10-21T12:03:40,644][INFO][logstash.inputs.udp][main][2d7a6d4cd7d2f4c7d12304be6f50e980c427cff2a74ff952e4d15f627639d192] UDP listener started {:address=>"<MYIP>:2055", :receive_buffer_bytes=>"106496", :queue_size=>"2000"}
[2020-10-21T12:03:40,894][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}

```

Here's my logstash.conf file, which is owned by the logstash user (test.log is also owned by logstash and has permissions 777)

```auto
input {
  udp {
    host => "<MYIP>"
    port => 2055
    codec => "netflow"
  }
}
output {
  file {
    path => "/var/log/logstash/test.log"
    codec => "json_lines"
  }
}

```

The netstat output

```auto
[root@specialhost specialuser]# netstat -ulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name    
udp 0 0 127.0.0.1:323 0.0.0.0:* 681/chronyd         
udp 0 0 <MYIP>:2055 0.0.0.0:* 1792/java           
udp6 0 0 ::1:323

```

A few things:

- I know there's a logstash module for netflow (this works btw), but for now, I want to use the UDP plugin
- I tried to run logstash as root as some posts suggested but makes no difference
- I also left logstash running overnight, as suggested by some posts
- SELinux and FW are disabled for now
- I also tried to use rsyslog to redirect logs to another port, but no luck
- I tested the connection with netcat and I can receive messages
- Using TCP is not an option

Does anyone see any issue that I don't? Or someone has something new for me to try?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2020, 12:31pm UTC](https://discuss.elastic.co/t/not-able-to-process-udp-traffic/252838/2 "2020-11-18T12:31:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.