# UDP listener died but conf file seems ok

**URL:** <https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973>\
**Category:** Logstash\
**Created:** [August 31, 2017, 8:55am UTC](https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973 "2017-08-31T08:55:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sever](https://avatars.discourse-cdn.com/v4/letter/s/cab0a1/32.png) [@Sever](https://discuss.elastic.co/u/Sever)\
**Post date:** [August 31, 2017, 8:55am UTC](https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973/1 "2017-08-31T08:55:11Z")

</div>

Hi i have a problem with logstash. I try to open port 5514, but when i start logstash, the port doesnt work. in Log i can see that UDP listener start and then shutting down. I don't know why

> [2017-08-31T08:31:23,647][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://localhost:9200/](http://localhost:9200/)]}}  
> [2017-08-31T08:31:23,764][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"}  
> [2017-08-31T08:31:24,166][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x6d3c06e3 URL:[http://localhost:9200/](http://localhost:9200/)\>}  
> [2017-08-31T08:31:24,169][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
> [2017-08-31T08:31:24,583][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
> [2017-08-31T08:31:24,600][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>[#\<URI::Generic:0xd1c05e7 URL://localhost:9200\>]}  
> [2017-08-31T08:31:25,981][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>1000}  
> [2017-08-31T08:31:26,023][INFO][logstash.pipeline] Pipeline main started  
> [2017-08-31T08:31:26,041][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"0.0.0.0:5514"}  
> [2017-08-31T08:31:26,266][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
> [2017-08-31T08:31:26,297][INFO][logstash.inputs.udp] UDP listener started {:address=\>"0.0.0.0:5514", :receive\_buffer\_bytes=\>"8388608", :queue\_size=\>"2000"}  
> [2017-08-31T08:31:56,001][WARN][logstash.runner] SIGINT received. Shutting down the agent.  
> [2017-08-31T08:31:56,048][WARN][logstash.agent] stopping pipeline {:id=\>"main"}  
> [2017-08-31T08:31:56,420][WARN][logstash.inputs.udp] UDP listener died {:exception=\>#\<IOError: closed stream\>, :backtrace=\>["org/jruby/RubyIO.java:3705:in `select'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:93:in `udp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:56:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:443:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:436:in `start\_input'"]}

and my config file looks like this:

> input {  
> udp {  
> port =\> 5514  
> type =\> "syslog"  
> }  
> }
> 
> filter {  
> if [type] == "syslog" {  
> if "%ASA-" in [message] or "%PIX-" in [message] {  
> # Parse the syslog severity and facility  
> grok {  
> match =\> [  
> "message", "%{CISCOFW106001}",  
> "message", "%{CISCOFW106006\_106007\_106010}",  
> "message", "%{CISCOFW106014}",  
> "message", "%{CISCOFW106015}",  
> "message", "%{CISCOFW106021}",  
> "message", "%{CISCOFW106023}",  
> "message", "%{CISCOFW106100}",  
> "message", "%{CISCOFW110002}",  
> "message", "%{CISCOFW302010}",  
> "message", "%{CISCOFW302013\_302014\_302015\_302016}",  
> "message", "%{CISCOFW302020\_302021}",  
> "message", "%{CISCOFW305011}",  
> "message", "%{CISCOFW313001\_313004\_313008}",  
> "message", "%{CISCOFW313005}",  
> "message", "%{CISCOFW402117}",  
> "message", "%{CISCOFW402119}",  
> "message", "%{CISCOFW419001}",  
> "message", "%{CISCOFW419002}",  
> "message", "%{CISCOFW500004}",  
> "message", "%{CISCOFW602303\_602304}",  
> "message", "%{CISCOFW710001\_710002\_710003\_710005\_710006}",  
> "message", "%{CISCOFW713172}",  
> "message", "%{CISCOFW733100}"  
> ]  
> }  
> }  
> }
> 
> ```
> grok {
> match => ["message", "<%{NUMBER}>%{NUMBER} %{TIMESTAMP_ISO8601} %{IPORHOST:orig_host} %{DATA:device_message}"]
> }
> 
> ```
> 
> }
> 
> output {  
> elasticsearch { hosts =\> ["localhost:9200"] }  
> #stdout { codec =\> json }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2017, 8:55am UTC](https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973/2 "2017-09-28T08:55:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.