# Setup Filebeat with UDP input .. several questions

**URL:** https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522
**Category:** Beats
**Tags:** filebeat
**Created:** [October 19, 2020, 9:41am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522 "2020-10-19T09:41:07Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![dewell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dewell/32/84214_2.png) [@dewell](https://discuss.elastic.co/u/dewell)
#### Post date: [October 19, 2020, 9:41am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/1 "2020-10-19T09:41:07Z")

</div>

Hi, I'm trying to grab a udp stream of double values (8 bytes) via udp input plugin of filebeat.

The connection is between two servers in the same subnet, there shouldn't be any issue.

I changed the filebeat.yml like this to keep the start as simple as possible:

```
filebeat.inputs:
type: udp
enabled: true
host: "10.10.112.20:7200"

```

When I start filebeat I get one error regarding the port. If I put in a port it is:

`2020-10-19T11:35:20.982+0200 ERROR udp/input.go:106 Error running harvester: listen udp 10.10.112.20:7200: bind: cannot assign requested address`

If not it is:

`2020-10-19T11:27:23.899+0200 ERROR udp/input.go:106 Error running harvester: address 10.10.112.20: missing port in address`

The second issue I have is understanding the periodically upcoming monitoring messages. The udp sender sends 100 double values a second and I wonder where in the message I would recognize if I received them or not:

`2020-10-19T11:37:14.079+0200 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":20,"time":{"ms":1}},"total":{"ticks":90,"time":{"ms":9},"value":90},"user":{"ticks":70,"time":{"ms":8}}},"handles":{"limit":{"hard":1048576,"soft":1024},"open":11},"info":{"ephemeral_id":"c103e98f-6c7c-4c53-80f1-8b549508e030","uptime":{"ms":90025}},"memstats":{"gc_next":9499200,"memory_alloc":7560920,"memory_total":16450560},"runtime":{"goroutines":55}},"filebeat":{"events":{"added":1,"done":1},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":1,"batches":1,"total":1},"read":{"bytes":347},"write":{"bytes":2447}},"pipeline":{"clients":5,"events":{"active":0,"published":1,"total":1},"queue":{"acked":1}}},"registrar":{"states":{"current":11,"update":1},"writes":{"success":1,"total":1}},"system":{"load":{"1":0.1,"15":0.08,"5":0.08,"norm":{"1":0.0167,"15":0.0133,"5":0.0133}}}}}}`

I couldn't find any tutorial or example to explain the output I receive.  
Thanks in advance for your help!

---

<div class="post-metadata">

### Author: ![dewell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dewell/32/84214_2.png) [@dewell](https://discuss.elastic.co/u/dewell)
#### Post date: [October 29, 2020, 5:40pm UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/2 "2020-10-29T17:40:09Z")

</div>

Maybe it wasn't smart to put 2 questions into it. Maybe someone could help with the first problem. The binding of a port doesn't work, even on a free port on the localhost I get this error 😕

I still couldn't receive any udp messages

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [October 30, 2020, 9:46am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/3 "2020-10-30T09:46:54Z")

</div>

Hi!

The error is because of the IP you are using. You can try with `localhost`, `0.0.0.0` or `127.0.0.1` to fix it.

---

<div class="post-metadata">

### Author: ![dewell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dewell/32/84214_2.png) [@dewell](https://discuss.elastic.co/u/dewell)
#### Post date: [November 3, 2020, 9:18am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/4 "2020-11-03T09:18:33Z")

</div>

Hi Chris, thank you for your answer.  
Indeed, using localhost:7200, for instance, works without an error. So I guess I have to talk to the people who set up our virtual machines why they can't connect to each other.

About my other question: Any recommended sources where I can learn what all the monitoring output of the udp plugin means?

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [November 3, 2020, 9:52am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/5 "2020-11-03T09:52:17Z")

</div>

Hi!

UDP input is just an input method. So the output it will provide has to do with the data that you are forwarding to it.

---

<div class="post-metadata">

### Author: ![dewell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dewell/32/84214_2.png) [@dewell](https://discuss.elastic.co/u/dewell)
#### Post date: [November 3, 2020, 10:32am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/6 "2020-11-03T10:32:46Z")

</div>

But there is a lot of metadata that gets put out in the console (see my original post)  
I found it hard to figure out what's actually happening after "Non-zero metrics in the last 30s" ..

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [November 3, 2020, 11:27am UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/7 "2020-11-03T11:27:58Z")

</div>

The output you see (after `Non-zero metrics in the last 30s`) is reporting Filebeat's internal metrics like how many events have been processed etc..

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2020, 1:28pm UTC](https://discuss.elastic.co/t/setup-filebeat-with-udp-input-several-questions/252522/8 "2020-12-01T13:28:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
