Logstash doesn't start. Error: "Could not start TCP server: Address in use"

Question

Logstash doesn't start. It says following:

 :message=>"Could not start TCP server: Address in use", :host=>"0.0.0.0", :port=>1514, :level=>:error}The error reported is: \n  Address already in use - bind - Address already in use"}

In logstash configuration file, port 1514 is not specified. And when logstash is stopped no service is listening on this port. When I start logstash and although I don't specify this port in configuration file, it starts listening on this port. If I put this port in logstash configuration file and start logstash it gives me the error that the address is in use. I need to use tcp/1514 port, because all my esxi hypervisors are configured to send logs to this port.

Why when I start logstash it starts listening on this port despite I dont have this port in the configuration file?

What can I do to successfully start logstash service using this port in configuration file?

Answer 1

The problem is that there were two configuration files used by logstash.

root@srv-syslog:~# locate central.conf
/etc/logstash/conf.d/central.conf
/etc/logstash/conf.d/central.conf.save

I deleted the second one and now everything is ok.