Tcp server output, "Address already in use" after upgrade to 2.2

Elastic Stack Logstash
#1

After upgrade to 2.2 (logstash-2.2.2-1.noarch from the official yum repo), logstash fails to start with the following error.

{:timestamp=>"2016-03-04T10:45:12.833000+0000", :message=>"The error reported is: \n Address already in use - bind - Address already in use"}

By selectively removing bits of config until the error went away, I was able to isolate the problem to the tcp server output config. I couldn't see any duplicate ports in the config and nothing other than logstash was using the port (not to mention the fact that the config was fine before the upgrade).

Still, I wondered if somehow something else in the config was causing the problem, so I decided to try a clean configuration of the 2.2 RPM in an empty container with only the tcp output configured. The Dockerfile I used is here:

Exactly the same problem.

I suspect a bug in logstash and I will start delving into the source when I get some time with a view to raising this as an issue. For now I was wondering if anyone had the same problem and knew of a workaround.

#2

output { tcp { port => 1444 host => "0.0.0.0" mode => server } }

I don't see how mode => server could make sense. An output should act as a TCP client, not a server. Also, 0.0.0.0 isn't a valid host to connect to. Did you really intend this one to be an output?

#3

Unless something has changed, mode => server is fine. In this case 0.0.0.0 is the bind address for the tcp listen socket.

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-tcp.html

We provide this in dev environments so that people can watch events in real time by connecting to the socket.

#4

Ah, my bad. I didn't know the output could be used like that.

#5

I have same problem.

#6

I made issue on github

#7

Actually, it's even easier to demonstrate this behaviour by running a container based on the official logstash:latest image:

$ docker run --rm -it docker.io/logstash -e "output { tcp { port => 1444 host => '0.0.0.0' mode => server } }"
Settings: Default pipeline workers: 8
The error reported is: 
  Address already in use - bind - Address already in use
#8

Looks like this is fixed in the 2.3.0 release - presumably by this:

#9