logstash-input-syslog-3.2.0 error

[jsvd]

Migrated from https://github.com/elastic/logstash/issues/6330

---

Good morning everyone,

I'm having trouble with logstash-input-syslog plugin when i try to retrieve logs from a syslog server. I have a socket error:

[2016-11-30T09:51:32,898][INFO ][logstash.inputs.syslog ] Starting syslog tcp listener {:address=>"172.25.7.251:514"} [2016-11-30T09:51:32,901][INFO ][logstash.inputs.syslog ] Starting syslog udp listener {:address=>"172.25.7.251:514"} [2016-11-30T09:51:32,900][WARN ][logstash.inputs.syslog ] syslog listener died {:protocol=>:tcp, :address=>"172.25.7.251:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:ininitialize'", "org/jruby/RubyIO.java:871:in new'", "/usr/share/logstash/vendor/local_gems/1df3aae8/logstash-input-syslog-3.2.0/lib/logstash/inputs/syslog.rb:159:intcp_listener'", "/usr/share/logstash/vendor/local_gems/1df3aae8/logstash-input-syslog-3.2.0/lib/logstash/inputs/syslog.rb:122:in server'", "/usr/share/logstash/vendor/local_gems/1df3aae8/logstash-input-syslog-3.2.0/lib/logstash/inputs/syslog.rb:106:inrun'"]} ` I'm running:

RHEL 7.1 Elasticsearch, Logstash and Kibana running on the same machine (Version 5.0.1) (user: root) Syslog server running on a seperate machine (Rsyslog)

Config:

`input { syslog { host => "172.25.7.251" #Sylog IP Adress } }

filter { }

output {

elasticsearch {
  hosts => [ "172.25.7.151:9200" ]
}

} `

Thanks in advance for your help!!!

[crab86]

Do have nearly the same issue with syslog input. It started after upgrading from logstash 5.2.0 to 5.4.1:

[2017-06-23T15:08:00,471][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<NoMethodError: undefined methodeach' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.2.0/lib/logstash/inputs/syslog.rb:240:in close_tcp'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.2.0/lib/logstash/inputs/syslog.rb:225:instop'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:89:in do_stop'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:486:in shutdown'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:426:instop_pipeline'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:442:in shutdown_pipelines'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:442:in shutdown_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:139:inshutdown'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:289:in execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:185:in run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:inrun'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in (root)'"]}

Would be really glad if someone would be able to fix it.

[flashick]

The same error: An unexpected error occurred! {:error=>#<NoMethodError: undefined method each' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.2.2/lib/logstash/inputs/syslog.rb:240:inclose_tcp'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-3.2.2/lib/logstash/inputs/syslog.rb:225:in stop'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:89:indo_stop'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:515:inshutdown'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:426:in stop_pipeline'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:442:inshutdown_pipelines'", "org/jruby/RubyHash.java:1342:in each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:442:inshutdown_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:139:in shutdown'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:328:inexecute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204:inrun'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in(root)'"]}

[predominant]

@jsvd @crab86 @flashick I have the same problem. Any clues?

[flashick]

Yum update helped me. But I didn't remember what versions I had before and after update.

[crab86]

If i remember it correctly the problem i faced was that another syslog Daemon was listening on the same port as logstash tried to.