Udp 127.0.0.1:2055: bind: address already in use in 7.6 netflow module

Hi,

i've upgraded filebead from 7.5.2 to 7.6.2 and now filebeat constantly complain:

    2020-04-16T02:38:48.587+0300    INFO    crawler/crawler.go:72   Loading Inputs: 2
    2020-04-16T02:38:48.587+0300    INFO    input/input.go:114      Starting input of type: netflow; ID: 8714833438451968066
    2020-04-16T02:38:48.587+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:48.588+0300    INFO    [udp]   udp/server.go:81        Started listening for UDP connection    {"address": "0.0.0.0:2055"}
    2020-04-16T02:38:48.590+0300    INFO    crawler/crawler.go:106  Loading and starting Inputs completed. Enab2020-04-16T02:38:48.630+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:48.630+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use
    led inputs: 1
    2020-04-16T02:38:58.630+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:38:58.631+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use
    2020-04-16T02:39:08.631+0300    INFO    [netflow]       netflow/input.go:153    Starting UDP input
    2020-04-16T02:39:08.632+0300    ERROR   [netflow]       netflow/input.go:164    Error running harvester: listen udp 127.0.0.1:2055: bind: address already in use

netflow input in felibeat.yml defined as:

filebeat.inputs:

 - type: netflow
   max_message_size: 10KiB
   host: "0.0.0.0:2055"
   protocols: [ v5, v9, ipfix ]                                                                                                                              
   expiration_timeout: 30m
   queue_size: 8192
   detect_sequence_reset: true

why it complain about 127.0.0.1:2055 ?

There is nobody listen to udp port 2055 before I start filebeat
Moreover if I rollback to filebeat 7.5.2 - all errors about "bind: address already in us" are disappeared.

Could you please post an extended dump from netstat?

Sorry, I understood what was the matter. But why this happens?
As the documentation says, the default netflow input in filebeat.yml is defined as follows:
https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-input-netflow.html

filebeat.inputs:
- type: netflow
  host: "0.0.0.0:2055"

but in neflow module confuration file modules.d/netflow.yml we see port 2055 too:
https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-netflow.html

- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow_port: 2055

In version 7.5 I change port in modules.d/netflow.yml from 2055 to 2056 and get rid of bind errors. But why this two ports same by default ? What does each of them do?

my fault, https://www.elastic.co/guide/en/beats/filebeat/7.6/configuration-filebeat-options.html
says:

To configure Filebeat manually (instead of using modules), you specify a list of inputs in the filebeat.inputs section of the filebeat.yml . Inputs specify how Filebeat locates and processes input data.

So. I've deleted netflow input definition from filebeat.inputs infilebeat.yml and evething works fine.
Sorry.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.