Udp 127.0.0.1:2055: bind: address already in use in 7.6 netflow module

Elastic Stack Beats
1

Hi,

i've upgraded filebead from 7.5.2 to 7.6.2 and now filebeat constantly complain:

    2020-04-16T02:38:48.587+0300    INFO    crawler/crawler.go:72   Loading Inputs: 2
    2020-04-16T02:38:48.587+0300    INFO    input/input.go:114      Starting input of type: netflow; ID: 8714833438451968066
    2020-04-16T02:38:48.587+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:48.588+0300    INFO    [udp]   udp/server.go:81        Started listening for UDP connection    {"address": "0.0.0.0:2055"}
    2020-04-16T02:38:48.590+0300    INFO    crawler/crawler.go:106  Loading and starting Inputs completed. Enab2020-04-16T02:38:48.630+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:48.630+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use
    led inputs: 1
    2020-04-16T02:38:58.630+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:58.631+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use
    2020-04-16T02:39:08.631+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:39:08.632+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use

netflow input in felibeat.yml defined as:

filebeat.inputs:

 - type: netflow
   max_message_size: 10KiB
   host: "0.0.0.0:2055"
   protocols: [ v5, v9, ipfix ]                                                                                                                              
   expiration_timeout: 30m
   queue_size: 8192
   detect_sequence_reset: true

why it complain about 127.0.0.1:2055 ?

There is nobody listen to udp port 2055 before I start filebeat
Moreover if I rollback to filebeat 7.5.2 - all errors about "bind: address already in us" are disappeared.

2

Could you please post an extended dump from netstat?

4

Sorry, I understood what was the matter. But why this happens?
As the documentation says, the default netflow input in filebeat.yml is defined as follows:
https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-input-netflow.html

filebeat.inputs:
- type: netflow
  host: "0.0.0.0:2055"

but in neflow module confuration file modules.d/netflow.yml we see port 2055 too:
https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-netflow.html

- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow_port: 2055

In version 7.5 I change port in modules.d/netflow.yml from 2055 to 2056 and get rid of bind errors. But why this two ports same by default ? What does each of them do?

5

my fault, https://www.elastic.co/guide/en/beats/filebeat/7.6/configuration-filebeat-options.html
says:

To configure Filebeat manually (instead of using modules), you specify a list of inputs in the filebeat.inputs section of the filebeat.yml . Inputs specify how Filebeat locates and processes input data.

So. I've deleted netflow input definition from filebeat.inputs infilebeat.yml and evething works fine.
Sorry.