elastic / elastic/logstash

Logstash syslog input causing a "UDP Listener died" error

Open
#3,214 14 comments 5 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

Hi all,

I am trying to receive syslog input from a syslog server which is being fed logs from Docker containers via logspout.
I am rather sure that I configured the input correctly to receive syslog on port 5000. Here is my input config for syslog

```
syslog {
port => 5000
type => "docker_log"
}
```

And here is my full input config on pastebin: http://pastebin.com/qcX5tFTi

Here is the error I am receiving: http://pastebin.com/jJxZsULX

```
{:timestamp=>"2015-05-09T21:17:44.676000+0000", :message=>"UDP listener died", :exception=>#, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.3/lib/logstash/inputs/udp.rb:79:in `udp_listener'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.3/lib/logstash/inputs/udp.rb:49:in `run'", "/opt/logstash/lib/logstash/pipeline.rb:174:in `inputworker'", "/opt/logstash/lib/logstash/pipeline.rb:168:in `start_input'"], :level=>:warn}
```

The port is being used by Logstash, as shown by

```
sudo lsof -nPi :5000

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 6837 logstash 13u IPv6 1260946 0t0 UDP *:5000
java 6837 logstash 16u IPv6 1260947 0t0 TCP *:5000 (LISTEN)

```

I've tried reading up on this ticket https://github.com/elastic/logstash/issues/1896 but I don't think this is a reserved port issue or a permissions issue.

Could anyone help me debug this error? From what I can tell, my configuration is correct.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.