Output from logstash A into input of logstash B over tcp


I'm hoping someone can help me.

I'm trying to output data over tcp from one logstash (logstash A) into the input of another (logstash B).

These are my config files from logstash A:-

output {
  tcp {
         host => "XX.X.XXX.XXX" #ip address for logstash B
          mode => "server"
          port => 3389

logstash B config:

input {
      tcp {
       mode => "client"
      host => "XX.X.XX.XXXX"  #ip address of logstash A
      port => 3389

When I run logstash on logstash A, I receive the following error.

Errno::EADDRNOTAVAIL: Can't assign requested address - bind - Cannot assign requested address: bind
initialize at org/jruby/ext/socket/RubyTCPServer.java:118
new at org/jruby/RubyIO.java:852
register at c:/logstash/lib/logstash/outputs/tcp.rb:76
each at org/jruby/RubyArray.java:1613
outputworker at c:/logstash/lib/logstash/pipeline.rb:220
start_outputs at c:/logstash/lib/logstash/pipeline.rb

I've done a netstat -anp tcp | find ":3389" and the results show:-


I can see that port 3389 has been allocated as a source port but can't seem to configure it to get the data transfer working.

Can you please tell what I'm doing wrong?

1 Like

You're mixing up client and server. It's the over way around; the output plugin acts as a client and sends data to an input client that acts as a server. But just skip the mode parameter. It's not needed here.

many thanks magnus. that worked a treat!

can you configure the output for tcp so that you pass multiple hosts ( "aa.aa.aa.aa", "bb.bb.bb.bb")?

output {
host => "aa.aa.aa.aa", "bb.bb.bb.bb"
port => 1234

Multiple hosts meaning round robin between the supplied hosts? No, that's not supported.