# TCP input is not starting for logstash
**URL:** https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002
**Category:** Logstash
**Tags:** elastic-stack-monitoring
**Created:** [July 10, 2025, 2:24pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002 "2025-07-10T14:24:18Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)
#### Post date: [July 10, 2025, 2:24pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/1 "2025-07-10T14:24:18Z")
Hi Elastic experts,
I am configuring logstash configuration file with tcp input as per below. Since, I haven't configure ssl certificate. So, I have disabled secure ssl mode.
```auto
tcp {
port => 5244
tags => ["proxy"]
ssl_verification_mode => "none"
}
```
While starting the logstash I could see starting tcp input listener as below and port is listening but I don't see traffic is receiving towards the port 5244 through tcp dump.
```auto
[INFO][logstash.inputs.tcp][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=>"0.0.0.0:5244", :ssl_enabled=>false}
```
Please suggest what is the issue and how to fix it.
Regards,
Eshwar
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 10, 2025, 2:59pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/2 "2025-07-10T14:59:23Z")
What else do you have in the logs?
From what you shared there is no indication that there is an issue.
You need to share the rest of the logs.
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [July 10, 2025, 3:03pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/3 "2025-07-10T15:03:01Z")
> [@Eshwar\_K](#):
>
> Please suggest what is the issue
Nothing is sending traffic to port 5244 on that host? Or, if something is, it is being blocked / dropped by some firewall or similar before it reaches logstash (the application).
> [@Eshwar\_K](#):
>
> ... and how to fix it.
Send it some traffic and/or allow the traffic?
What the source of the traffic you are _expecting_ to see on port 5244 on that host ?
---
### Author:  [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)
#### Post date: [July 10, 2025, 3:27pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/4 "2025-07-10T15:27:46Z")
`@leandrojmp and @RainTown, thank you for your quick response.`
`@leandrojmp`
I don't see any logs apart from the shared Info for TCP. I have enabled debug but I could see only staring o thread for TCP.
My logstash configuration has multiple inputs which includes UDP and TCP. UDP input is working fine but when comes to TCP process is not starting.
I am sharing the complete logs for your reference.
```auto
[2025-07-10T10:00:10,931][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.75}
[2025-07-10T10:00:10,944][WARN][logstash.inputs.tcp][main] Configured SSL settings are not used when `ssl_enabled` is set to `false`: ["ssl_verification_mode"]
[2025-07-10T10:00:10,953][DEBUG][io.netty.util.internal.logging.InternalLoggerFactory][main] Using SLF4J as the default logging framework
[2025-07-10T10:00:10,955][DEBUG][io.netty.channel.MultithreadEventLoopGroup][main] -Dio.netty.eventLoopThreads: 8
[2025-07-10T10:00:10,963][DEBUG][io.netty.util.concurrent.GlobalEventExecutor][main] -Dio.netty.globalEventExecutor.quietPeriodSeconds: 1
[2025-07-10T10:00:10,969][DEBUG][io.netty.util.internal.InternalThreadLocalMap][main] -Dio.netty.threadLocalMap.stringBuilder.initialSize: 1024
[2025-07-10T10:00:10,969][DEBUG][io.netty.util.internal.InternalThreadLocalMap][main] -Dio.netty.threadLocalMap.stringBuilder.maxSize: 4096
[2025-07-10T10:00:10,995][DEBUG][io.netty.util.internal.PlatformDependent0][main] -Dio.netty.noUnsafe: false
[2025-07-10T10:00:10,995][DEBUG][io.netty.util.internal.PlatformDependent0][main] Java version: 21
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe.theUnsafe: available
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe base methods: all available
[2025-07-10T10:00:10,996][DEBUG][io.netty.util.internal.PlatformDependent0][main] sun.misc.Unsafe.storeFence: available
[2025-07-10T10:00:10,997][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.Buffer.address: available
[2025-07-10T10:00:10,997][DEBUG][io.netty.util.internal.PlatformDependent0][main] direct buffer constructor: unavailable: Reflective setAccessible(true) disabled
[2025-07-10T10:00:10,998][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.Bits.unaligned: available, true
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent0][main] jdk.internal.misc.Unsafe.allocateUninitializedArray(int): unavailable: class io.netty.util.internal.PlatformDependent0$7 cannot access class jdk.internal.misc.Unsafe (in module java.base) because module java.base does not export jdk.internal.misc to unnamed module @5fe3b487
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent0][main] java.nio.DirectByteBuffer.(long, {int,long}): unavailable
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] sun.misc.Unsafe: available
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.tmpdir: /tmp (java.io.tmpdir)
[2025-07-10T10:00:10,999][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.bitMode: 64 (sun.arch.data.model)
[2025-07-10T10:00:11,000][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.maxDirectMemory: -1 bytes
[2025-07-10T10:00:11,000][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.uninitializedArrayAllocationThreshold: -1
[2025-07-10T10:00:11,001][DEBUG][io.netty.util.internal.CleanerJava9][main] java.nio.ByteBuffer.cleaner(): available
[2025-07-10T10:00:11,001][DEBUG][io.netty.util.internal.PlatformDependent][main] -Dio.netty.noPreferDirect: false
[2025-07-10T10:00:11,002][DEBUG][io.netty.channel.nio.NioEventLoop][main] -Dio.netty.noKeySetOptimization: false
[2025-07-10T10:00:11,002][DEBUG][io.netty.channel.nio.NioEventLoop][main] -Dio.netty.selectorAutoRebuildThreshold: 512
[2025-07-10T10:00:11,008][DEBUG][io.netty.util.internal.PlatformDependent][main] org.jctools-core.MpscChunkedArrayQueue: available
[2025-07-10T10:00:11,023][INFO][logstash.inputs.tcp][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=>"0.0.0.0:5244", :ssl_enabled=>false}
[2025-07-10T10:00:11,030][DEBUG][logstash.inputs.udp][main][caeeae7dedc9cc308e89e0e3bac31017133d429305f551dd7a84af72c89dbc10] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,033][DEBUG][io.netty.channel.DefaultChannelId][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Dio.netty.processId: 1054965 (auto-detected)
[2025-07-10T10:00:11,034][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}
[2025-07-10T10:00:11,038][DEBUG][logstash.inputs.udp][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@id = "plain_d609574e-4241-4e75-9686-064900392f39"
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@enable_metric = true
[2025-07-10T10:00:11,040][DEBUG][logstash.codecs.plain][main][ca3d21565ec46094c71c537e201d872f84572bcb0463137346cadeab99f11e91] config LogStash::Codecs::Plain/@charset = "UTF-8"
[2025-07-10T10:00:11,039][DEBUG][logstash.inputs.udp][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] Starting UDP worker thread {:worker=>1}
[2025-07-10T10:00:11,042][DEBUG][io.netty.util.NetUtil][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Djava.net.preferIPv4Stack: false
[2025-07-10T10:00:11,043][DEBUG][io.netty.util.NetUtil][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] -Djava.net.preferIPv6Addresses: false
[2025-07-10T10:00:11,043][DEBUG][logstash.codecs.plain][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@id = "plain_7b458801-9f61-42b4-84c8-d030fe850f40"
[2025-07-10T10:00:11,046][DEBUG][logstash.codecs.plain][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@enable_metric = true
[2025-07-10T10:00:11,046][DEBUG][logstash.codecs.plain][main][5b927f8f594486d13d7d3b38c18dcad45df10b9971937085b72925c683776d99] config LogStash::Codecs::Plain/@charset = "UTF-8"
[2025-07-10T10:00:11,045][DEBUG][logstash.javapipeline] Pipeline started successfully {:pipeline_id=>"main"
```
@RainTown , We are trying to send proxy logs to the logstash for parsing.1
I don't see any traffic to port 5244 on this host.
```auto
[root@kyn-logstash-1 ~]# tcpdump -i any -n tcp dst port 5244
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
```
For your info, firewall is disabled on this host.
Thank you for your suggestions in advance
Regards,
Eshwar
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 10, 2025, 3:34pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/5 "2025-07-10T15:34:25Z")
> [@Eshwar\_K](#):
>
> ince, I haven't configure ssl certificate. So, I have disabled secure ssl mode.
This doesn't make sense. TLS is disabled by default, so modifying the verification mode has no effect. That's what the log file is telling you:
> [WARN][logstash.inputs.tcp][main] Configured SSL settings are not used when `ssl_enabled` is set to `false`: ["ssl\_verification\_mode"]
Are the clients using TLS or not?
---
### Author:  [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)
#### Post date: [July 10, 2025, 3:47pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/6 "2025-07-10T15:47:46Z")
Hi @Badger ,
No, client is not using TLS.
Regards,
Eshwar
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 10, 2025, 4:40pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/7 "2025-07-10T16:40:28Z")
Can you disable DEBUG logs? They add too much noise and are rarely necessary.
I see no errors in your logs, if possible disable DEBUG log, restart Logstash and share the logs again.
There is a line in your log that says that the listener was started without issues:
> [2025-07-10T10:00:11,023][INFO][logstash.inputs.tcp][main][23d171feafa1e769698eec5cb7f34802841d001dbff67f14887bd1bebc67209e] Starting tcp input listener {:address=\>"0.0.0.0:5244", :ssl\_enabled=\>false}
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [July 10, 2025, 5:16pm UTC](https://discuss.elastic.co/t/tcp-input-is-not-starting-for-logstash/380002/8 "2025-07-10T17:16:13Z")
> [@Eshwar\_K](#):
>
> My logstash configuration has multiple inputs which includes UDP and TCP. UDP input is working fine but when comes to TCP process is not starting.
There is nothing in what you have shared to suggest the "TCP process is not starting". What I, and others, see suggests it is starting.
What does
```auto
PORT=5244 ; nc -z -w 1 localhost $PORT ; if [$? -eq 0]; then echo "Port $PORT is open" ; else echo "Port $PORT is closed" ; fi
```
return?
Or
```auto
PORT=5244 && if (echo >/dev/tcp/localhost/$PORT) &>/dev/null; then echo "Port $PORT is open"; else echo "Port $PORT is closed"; fi
```
Your tcpdump is rather showing no tcp traffic reached that server's port 5244.
Assuming a Linux system, after you start logstash, do a `sudo lsof -Pni :5244` and you will (I expect) see a java process listening for TCP traffic on port 5244. Its not a logstash issue if no traffic is reaching that port.
If you know a specific source of the traffic to port 5244 on your logstash server, you can tcpdump at that source point, and intermediate points, and try to follow it through your network, see where it might get lost/dropped/whatever.
Might also help if you tell us a little about your topology/setup. e.g. is logstash running inside some VM environment, or docker, or ... ?