rsyslogd cannot connect & ECS v8 support is a preview of the unreleased ECS v8 and uses the v1 patterns

[Giosue]

After applying this fix: viewtopic.php?p=363345&hilit=logstash#p363345

The NLS is now receiving the logs, but we are encountering some warnings and errors.
---
Jun 25 10:06:17 "hostname" rsyslogd cannot connect to "ip_of_my_machine":5544 (took 0.00 seconds): Connection refused [v8.2604.0-1.el9 try https://www.rsyslog.com/e/2027 ]
---
and
---
Jun 25 10:10:52 "FQDN" logstash[1003]: [2026-06-25T10:10:52,221][WARN ][logstash.filters.grok][main] ECS v8 support is a preview of the unreleased ECS v8 and uses the v1 patterns. When version 8 of the Elastic Common Schema becomes available, this plugin will need to be updated.
---
Version: 2026R1.4

[jmichaelson]

Very glad to hear you're receiving logs.

I'm going to get to the second question first. that's just a warning that can be safely ignored. we're actively checking out the latest versions of those plugins which should make those warnings disappear.

As for the rsyslogd message, where is it coming from? Your log server itself or another system? if another system, can you connect to the log server from it on port 5544?

[Giosue]

Very glad to hear you're receiving logs.

I'm going to get to the second question first. that's just a warning that can be safely ignored. we're actively checking out the latest versions of those plugins which should make those warnings disappear.

As for the rsyslogd message, where is it coming from? Your log server itself or another system? if another system, can you connect to the log server from it on port 5544?

The rsyslogd message is generated by the log server itself, using its IP address rather than 127.0.0.1.

[jmichaelson]

does running netstat -a show anything listening on port 5544?

[Giosue]

does running netstat -a show anything listening on port 5544?

Running netstat -a shows no service listening on port 5544.

[jmichaelson]

Ho about netstat -anp. What java processes are showing as running? How about systemctl status logstash.srvice?

[Giosue]

Ho about netstat -anp. What java processes are showing as running? How about systemctl status logstash.srvice?

netstat -anp | grep 5544
- shows nothing

netstat -anp | grep java

tcp6 0 0 127.0.0.1:9600 :::* LISTEN 1003/java
tcp6 0 0 :::9300 :::* LISTEN 1181/java
tcp6 0 0 :::9200 :::* LISTEN 1181/java
tcp6 0 0 :::5546 :::* LISTEN 1003/java
tcp6 0 0 :::3516 :::* LISTEN 1003/java
tcp6 0 0 :::3515 :::* LISTEN 1003/java
tcp6 0 0 :::2057 :::* LISTEN 1003/java
tcp6 0 0 :::2056 :::* LISTEN 1003/java
tcp6 0 0 :::514 :::* LISTEN 1003/java
tcp6 0 0 myip:9200 myip:42588 VERBUNDEN 1181/java
tcp6 0 0 myip:48162 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:9200 myip:42596 VERBUNDEN 1181/java
tcp6 0 0 myip:9200 myip:48160 VERBUNDEN 1181/java
tcp6 0 0 myip:55458 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:42594 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:42596 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:42604 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:42588 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:48160 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:9200 myip:42604 VERBUNDEN 1181/java
tcp6 0 0 myip:9200 myip:55458 VERBUNDEN 1181/java
tcp6 0 0 myip:42618 myip:9200 VERBUNDEN 1003/java
tcp6 0 0 myip:9200 myip:42618 VERBUNDEN 1181/java
tcp6 0 0 myip:9200 myip:48162 VERBUNDEN 1181/java
tcp6 0 0 myip:9200 myip:42594 VERBUNDEN 1181/java
udp 0 0 0.0.0.0:514 0.0.0.0:* 1003/java
udp 0 0 0.0.0.0:5546 0.0.0.0:* 1003/java
unix 3 [ ] STREAM VERBUNDEN 18067 1003/java
unix 2 [ ] STREAM VERBUNDEN 33042 1003/java
unix 3 [ ] STREAM VERBUNDEN 738 1181/java
unix 2 [ ] STREAM VERBUNDEN 32094 1181/java

top | grep java
1003 nagios 39 19 7010504 1.4g 33040 S 6.7 4.5 198:14.08 java
1181 nagios 20 0 9959660 2.4g 296216 S 6.7 7.8 478:44.42 java

systemctl status logstash.service
● logstash.service - logstash
Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: disabled)
Active: active (running) since Thu 2026-06-25 10:10:33 CEST; 5 days ago
Main PID: 1003 (java)
Tasks: 78 (limit: 203240)
Memory: 1.5G (peak: 1.5G)
CPU: 3h 18min 17.490s
CGroup: /system.slice/logstash.service
└─1003 /usr/local/nagioslogserver/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Dlog4j2.isThreadContextMapInheritable=true -Djava.io.tmpdir=/usr/local/nagioslogserver/tmp -Djruby.regexp.interruptible=true -Djdk.io.File.enableADS=true --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio.channels=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/sun.management=ALL-UNNAMED -Dio.netty.allocator.maxOrder=11 -cp /usr/local/nagioslogserver/logstash/vendor/jruby/lib/jruby.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/checker-qual-3.33.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/checker-qual-3.42.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/commons-codec-1.15.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/commons-codec-1.17.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/commons-logging-1.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/commons-logging-1.3.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/error_prone_annotations-2.18.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/error_prone_annotations-2.26.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/failureaccess-1.0.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/failureaccess-1.0.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/google-java-format-1.15.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/google-java-format-1.22.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/guava-32.1.2-jre.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/guava-33.1.0-jre.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/httpclient-4.5.13.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/httpclient-4.5.14.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/httpcore-4.4.14.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/httpcore-4.4.16.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-annotations-2.15.3.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-annotations-2.16.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-core-2.15.3.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-core-2.16.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-databind-2.15.3.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-databind-2.16.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.15.3.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.16.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/janino-3.1.0.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/javassist-3.29.0-GA.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/javassist-3.30.2-GA.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jsr305-3.0.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jvm-options-parser-8.13.4.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/jvm-options-parser-9.1.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-api-2.17.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-api-2.17.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-core-2.17.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-core-2.17.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-jcl-2.17.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-jcl-2.17.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.1.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/reflections-0.10.2.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/slf4j-api-1.7.32.jar:/usr/local/nagioslogserver/logstash/logstash-core/lib/jars/snakeyaml-2.2.jar org.logstash.Logstash -f /usr/local/nagioslogserver/logstash/etc/conf.d

Jul 01 09:17:32 "fqdn" logstash[1003]: [2026-07-01T09:17:32,151][WARN ][logstash.codecs.plain ][main][Syslog (Default)] Received an event that has a different character encoding than you configured. {:text=>"<135>1 2026-07-01T07:17:34Z "host" - - default Message 1971 0 : \\\"Copy client expression: hash: 16, \\u001Dþb\\u0019{\\xB3\\xD1\\xC4&\\xBC]y\\xE6\\u0017\\u0011, #bits:1\\\"\\n", :expected_charset=>"UTF-8"}

[jmichaelson]

Code: Select all

tcp6 0 0 :::514 :::* LISTEN 1003/java

did you change the Logstash Inputs configuration to use port 514 instead of 5544? that may be the problem

[Giosue]

Code: Select all

tcp6 0 0 :::514 :::* LISTEN 1003/java

did you change the Logstash Inputs configuration to use port 514 instead of 5544? that may be the problem

Yes, we had previously modified the default input, "Syslog (Default)", to listen on port 514 instead of 5544.

I have now created a dedicated input called "Syslog 514" to listen on port 514 and restored the default input to its original configuration. As soon as I applied the changes, the error messages stopped appearing.

[jmichaelson]

That makes sense. we configure the local rsyslog to send to port 5544.

Posting this for anyone else who encounters a similar problem; you can also edit the rsyslog config to point it back to port 514 on the log server machine.