# Windows logstash problem **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2017, 1:51pm UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672 "2017-03-07T13:51:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\ **Post date:** [March 7, 2017, 1:51pm UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/1 "2017-03-07T13:51:21Z")
hi im running version 2,4.1 on a windows 2012 server, I have run the ELK stack sucessfully on linux but in order to get it in production i must migrate to windows. I thought i could just move everything to the wintel platform no problem now i get this hen i start the logstash i start with logstash.bat -f c:\blabala\bla.conf e[33mUDP listener died {:exception=\>#\, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:67:in`udp\_listener'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:50:in `run'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:342:in`inputworker'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:336:in `start\_input'"], :level=\>:warn}e[0m ## logstash conf file input { stdin {} #firewall logs udp{ type =\> "cisco-asa" port =\> 514 } } ######################### filter { if [type] == "cisco-asa" { # Split the syslog part and Cisco tag out of the message grok { match =\> ["message", "%{CISCO\_TAGGED\_SYSLOG} %{GREEDYDATA:cisco\_message}"] } # Parse the syslog severity and facility syslog\_pri { } # Parse the date from the "timestamp" field to the "@timestamp" field date { match =\> ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss" ] timezone =\> "Europe/Paris" } # Clean up redundant fields if parsing was successful if "\_grokparsefailure" not in [tags] { mutate { rename =\> ["cisco\_message", "message"] remove\_field =\> ["timestamp"] } } # Extract fields from the each of the detailed message types # The patterns provided below are included in Logstash since 1.2.0 grok { match =\> [ "message", "%{CISCOFW106001}", "message", "%{CISCOFW106006\_106007\_106010}", "message", "%{CISCOFW106014}", "message", "%{CISCOFW106015}", "message", "%{CISCOFW106021}", "message", "%{CISCOFW106023}", "message", "%{CISCOFW106100}", "message", "%{CISCOFW110002}", "message", "%{CISCOFW302010}", "message", "%{CISCOFW302013\_302014\_302015\_302016}", "message", "%{CISCOFW302020\_302021}", "message", "%{CISCOFW305011}", "message", "%{CISCOFW313001\_313004\_313008}", "message", "%{CISCOFW313005}", "message", "%{CISCOFW402117}", "message", "%{CISCOFW402119}", "message", "%{CISCOFW419001}", "message", "%{CISCOFW419002}", "message", "%{CISCOFW500004}", "message", "%{CISCOFW602303\_602304}", "message", "%{CISCOFW710001\_710002\_710003\_710005\_710006}", "message", "%{CISCOFW713172}", "message", "%{CISCOFW733100}" ] } } ## } output { stdout { codec =\> rubydebug } elasticsearch { hosts =\> ["localhost:9200"] a test run of the conf file says ok C:\Elk\logstash-2.4.1\logstash-2.4.1\bin\>logstash.bat -f C:\Elk\logstash\config\logstash\_win5.conf -t JAVA\_OPTS was set to [-Xms1g -Xmx2g]. Logstash will trust these options, and not set any defaults that it might usually set Picked up \_JAVA\_OPTIONS: -Xms1024m -Xmx2048m Configuration OK what to do? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2017, 2:18pm UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/2 "2017-03-07T14:18:50Z")
Please format your log snippet as preformatted text so we can see what comes after `UDP listener died {:exception=>#`. ---
**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\ **Post date:** [March 8, 2017, 7:28am UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/3 "2017-03-08T07:28:19Z")
{:exception=\>#, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:160:in bind'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:67:inudp\_listener'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:50:in run'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:342:ininputworker'", "C:/Elk/logstash-2.4.1/logstash-2.4.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:336:in `start\_input'"], :level=\>:warn}e[0m ---
**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\ **Post date:** [March 8, 2017, 8:58am UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/4 "2017-03-08T08:58:00Z")
Ive solved it, somehow. I changed to logstash5.2.2 I removed the stdin{} in input section I removed the codec =\> rubydebug in the output section below is the working config for cisco asa firewalls and logstash * * * input { #firewall logs udp { port =\> 514 type =\> "cisco-asa" } } ######################### filter { if [type] == "cisco-asa" { # Split the syslog part and Cisco tag out of the message grok { match =\> ["message", "%{CISCO\_TAGGED\_SYSLOG} %{GREEDYDATA:cisco\_message}"] } # Parse the syslog severity and facility syslog\_pri { } # Parse the date from the "timestamp" field to the "@timestamp" field date { match =\> ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss" ] timezone =\> "Europe/Paris" } # Clean up redundant fields if parsing was successful if "\_grokparsefailure" not in [tags] { mutate { rename =\> ["cisco\_message", "message"] remove\_field =\> ["timestamp"] } } # Extract fields from the each of the detailed message types # The patterns provided below are included in Logstash since 1.2.0 grok { match =\> [ "message", "%{CISCOFW106001}", "message", "%{CISCOFW106006\_106007\_106010}", "message", "%{CISCOFW106014}", "message", "%{CISCOFW106015}", "message", "%{CISCOFW106021}", "message", "%{CISCOFW106023}", "message", "%{CISCOFW106100}", "message", "%{CISCOFW110002}", "message", "%{CISCOFW302010}", "message", "%{CISCOFW302013\_302014\_302015\_302016}", "message", "%{CISCOFW302020\_302021}", "message", "%{CISCOFW305011}", "message", "%{CISCOFW313001\_313004\_313008}", "message", "%{CISCOFW313005}", "message", "%{CISCOFW402117}", "message", "%{CISCOFW402119}", "message", "%{CISCOFW419001}", "message", "%{CISCOFW419002}", "message", "%{CISCOFW500004}", "message", "%{CISCOFW602303\_602304}", "message", "%{CISCOFW710001\_710002\_710003\_710005\_710006}", "message", "%{CISCOFW713172}", "message", "%{CISCOFW733100}" ] } } } output { elasticsearch { hosts =\> ["localhost:9200"] } } ---
**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\ **Post date:** [March 8, 2017, 9:33am UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/5 "2017-03-08T09:33:27Z")
created a git for this, > **[ssi0202/logstash-cisco-asa](https://github.com/ssi0202/logstash-cisco-asa)** > > logstash-cisco-asa - logstash config file that work with 5.2.2 and older versions of logstash. tested on windows 2012 platform ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2017, 9:33am UTC](https://discuss.elastic.co/t/windows-logstash-problem/77672/6 "2017-04-05T09:33:28Z")
Closed on April 5, 2017, 9:33am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.