TCP input is not starting for logstash

Elastic Stack Logstash
1

Hi Elastic experts,

I am configuring logstash configuration file with tcp input as per below. Since, I haven't configure ssl certificate. So, I have disabled secure ssl mode.

 tcp {
    port => 5244
    tags => ["proxy"]
    ssl_verification_mode => "none"
  }

While starting the logstash I could see starting tcp input listener as below and port is listening but I don't see traffic is receiving towards the port 5244 through tcp dump.

[INFO ][logstash.inputs.tcp      ][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=>"0.0.0.0:5244", :ssl_enabled=>false}

Please suggest what is the issue and how to fix it.

Regards,
Eshwar

2

What else do you have in the logs?

From what you shared there is no indication that there is an issue.

You need to share the rest of the logs.

3

Nothing is sending traffic to port 5244 on that host? Or, if something is, it is being blocked / dropped by some firewall or similar before it reaches logstash (the application).

Send it some traffic and/or allow the traffic?

What the source of the traffic you are expecting to see on port 5244 on that host ?

4

@leandrojmp and @RainTown, thank you for your quick response.

@leandrojmp
I don't see any logs apart from the shared Info for TCP. I have enabled debug but I could see only staring o thread for TCP.

My logstash configuration has multiple inputs which includes UDP and TCP. UDP input is working fine but when comes to TCP process is not starting.

I am sharing the complete logs for your reference.

[2025-07-10T10:00:10,931][INFO ][logstash.javapipeline    ][main] Pipeline Java execution initialization time {"seconds"=>0.75}
[2025-07-10T10:00:10,944][WARN ][logstash.inputs.tcp      ][main] Configured SSL settings are not used when `ssl_enabled` is set to `false`: ["ssl_verification_mode"]
[2025-07-10T10:00:10,953][DEBUG][io.netty.util.internal.logging.InternalLoggerFactory][main] Using SLF4J as the default logging framework
[2025-07-10T10:00:10,955][DEBUG][io.netty.channel.MultithreadEventLoopGroup][main] -Dio.netty.eventLoopThreads: 8
[2025-07-10T10:00:10,963][DEBUG][io.netty.util.concurrent.GlobalEventExecutor][main] -Dio.netty.globalEventExecutor.quietPeriodSeconds: 1
[2025-07-10T10:00:10,969][DEBUG][io.netty.util.internal.InternalThreadLocalMap][main] -Dio.netty.threadLocalMap.stringBuilder.initialSize: 1024
[2025-07-10T10:00:10,969][DEBUG][io.netty.util.internal.InternalThreadLocalMap][main] -Dio.netty.threadLocalMap.stringBuilder.maxSize: 4096
[2025-07-10T10:00:10,995][DEBUG][io.netty.util.internal.PlatformDependent0][main] -Dio.netty.noUnsafe: false
[2025-07-10T10:00:10,995][DEBUG][io.netty.util.internal.PlatformDependent0][main] Java version: 21
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe.theUnsafe: available
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe base methods: all available
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe.storeFence: available
[2025-07-10T10:00:10,997][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.Buffer.address: available
[2025-07-10T10:00:10,997][DEBUG][io.netty.util.internal.PlatformDependent0][main] direct buffer constructor: unavailable: Reflective setAccessible(true) disabled
[2025-07-10T10:00:10,998][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.Bits.unaligned: available, true
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent0][main] jdk.internal.misc.Unsafe.allocateUninitializedArray(int): unavailable: class io.netty.util.internal.PlatformDependent0$7 cannot access class jdk.internal.misc.Unsafe (in module java.base) because module java.base does not export jdk.internal.misc to unnamed module @5fe3b487
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.DirectByteBuffer.<init>(long, {int,long}): unavailable
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] sun.misc.Unsafe: available
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.tmpdir: /tmp (java.io.tmpdir)
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.bitMode: 64 (sun.arch.data.model)
[2025-07-10T10:00:11,000][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.maxDirectMemory: -1 bytes
[2025-07-10T10:00:11,000][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.uninitializedArrayAllocationThreshold: -1
[2025-07-10T10:00:11,001][DEBUG][io.netty.util.internal.CleanerJava9][main] java.nio.ByteBuffer.cleaner(): available
[2025-07-10T10:00:11,001][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.noPreferDirect: false
[2025-07-10T10:00:11,002][DEBUG][io.netty.channel.nio.NioEventLoop][main] -Dio.netty.noKeySetOptimization: false
[2025-07-10T10:00:11,002][DEBUG][io.netty.channel.nio.NioEventLoop][main] -Dio.netty.selectorAutoRebuildThreshold: 512
[2025-07-10T10:00:11,008][DEBUG][io.netty.util.internal.PlatformDependent][main] org.jctools-core.MpscChunkedArrayQueue: available
[2025-07-10T10:00:11,023][INFO ][logstash.inputs.tcp      ][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=>"0.0.0.0:5244", :ssl_enabled=>false}
[2025-07-10T10:00:11,030][DEBUG][logstash.inputs.udp      ][main][caeeae7dedc9cc308e89e0e3bac31017133d429305f551dd7a84af72c89dbc10] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,033][DEBUG][io.netty.channel.DefaultChannelId][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Dio.netty.processId: 1054965 (auto-detected)
[2025-07-10T10:00:11,034][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id"=>"main"}
[2025-07-10T10:00:11,038][DEBUG][logstash.inputs.udp      ][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain    ][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@id = "plain_d609574e-4241-4e75-9686-064900392f39"
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain    ][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@enable_metric = true
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain    ][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@charset = "UTF-8"
[2025-07-10T10:00:11,039][DEBUG][logstash.inputs.udp      ][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,042][DEBUG][io.netty.util.NetUtil    ][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Djava.net.preferIPv4Stack: false
[2025-07-10T10:00:11,043][DEBUG][io.netty.util.NetUtil    ][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Djava.net.preferIPv6Addresses: false
[2025-07-10T10:00:11,043][DEBUG][logstash.codecs.plain    ][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@id = "plain_7b458801-9f61-42b4-84c8-d030fe850f40"
[2025-07-10T10:00:11,046][DEBUG][logstash.codecs.plain    ][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@enable_metric = true
[2025-07-10T10:00:11,046][DEBUG][logstash.codecs.plain    ][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@charset = "UTF-8"
[2025-07-10T10:00:11,045][DEBUG][logstash.javapipeline    ] Pipeline started successfully {:pipeline_id=>"main"

@RainTown , We are trying to send proxy logs to the logstash for parsing.1

I don't see any traffic to port 5244 on this host.

[root@kyn-logstash-1 ~]# tcpdump -i any -n tcp dst port 5244
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes

For your info, firewall is disabled on this host.

Thank you for your suggestions in advance

Regards,
Eshwar

5

This doesn't make sense. TLS is disabled by default, so modifying the verification mode has no effect. That's what the log file is telling you:

[WARN ][logstash.inputs.tcp ][main] Configured SSL settings are not used when ssl_enabled is set to false: ["ssl_verification_mode"]

Are the clients using TLS or not?

6

Hi @Badger ,

No, client is not using TLS.

Regards,
Eshwar

7

Can you disable DEBUG logs? They add too much noise and are rarely necessary.

I see no errors in your logs, if possible disable DEBUG log, restart Logstash and share the logs again.

There is a line in your log that says that the listener was started without issues:

[2025-07-10T10:00:11,023][INFO ][logstash.inputs.tcp ][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=>"0.0.0.0:5244", :ssl_enabled=>false}

8

There is nothing in what you have shared to suggest the "TCP process is not starting". What I, and others, see suggests it is starting.

What does

PORT=5244 ; nc -z -w 1 localhost $PORT ;  if [ $? -eq 0 ]; then   echo "Port $PORT is open" ; else  echo "Port $PORT is closed" ; fi

return?

Or

PORT=5244 && if (echo >/dev/tcp/localhost/$PORT) &>/dev/null; then   echo "Port $PORT is open"; else   echo "Port $PORT is closed"; fi

Your tcpdump is rather showing no tcp traffic reached that server's port 5244.

Assuming a Linux system, after you start logstash, do a sudo lsof -Pni :5244 and you will (I expect) see a java process listening for TCP traffic on port 5244. Its not a logstash issue if no traffic is reaching that port.

If you know a specific source of the traffic to port 5244 on your logstash server, you can tcpdump at that source point, and intermediate points, and try to follow it through your network, see where it might get lost/dropped/whatever.

Might also help if you tell us a little about your topology/setup. e.g. is logstash running inside some VM environment, or docker, or ... ?

1 Like