# Input with contentpack import

**URL:** <https://community.graylog.org/t/input-with-contentpack-import/24067>\
**Category:** Graylog Central (peer support)\
**Tags:** content-pack\
**Created:** [May 28, 2022, 10:10pm UTC](https://community.graylog.org/t/input-with-contentpack-import/24067 "2022-05-28T22:10:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [May 28, 2022, 10:10pm UTC](https://community.graylog.org/t/input-with-contentpack-import/24067/1 "2022-05-28T22:10:51Z")

</div>

Hi, I’m using Graylog 4.1.6  
I created a rule for text matching and I export it with it’s pipeline, stream and new input, using contentpack  
Upload and install is ok but when I look the input i see it not-started.  
So I click to start it but the failed message is visible.  
Looking the Graylog log I see this error:

```auto
2022-05-28 22:04:23,906 WARN : org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Failed to start channel for input BeatsInput{title=S-O365, type=org.graylog.plugins.beats.BeatsInput, nodeId=null}

io.netty.channel.unix.Errors$NativeIoException: bind(..) failed: Address already in use

2022-05-28 22:04:23,907 ERROR: org.graylog2.shared.inputs.InputLauncher - The [org.graylog.plugins.beats.BeatsInput] input with ID <62929c4d5bdb5a370bc5660c> misfired. Reason: bind(..) failed: Address already in use.

org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(..) failed: Address already in use

```

But it not possible as the port 5044 is not present in other input  
Where I’m doing wrong? Why Graylog say me that it is already used?

---

<div class="post-metadata">

**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\
**Post date:** [May 30, 2022, 7:38am UTC](https://community.graylog.org/t/input-with-contentpack-import/24067/2 "2022-05-30T07:38:44Z")

</div>

Graylog is just passing through the IO error from the operating system. If none of your inputs is using 5044, then some other application must be.

Use something like `sudo netstat -tunlp` to see what is listening on 5044.  
Or just use a different port.

---

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [May 30, 2022, 10:37am UTC](https://community.graylog.org/t/input-with-contentpack-import/24067/3 "2022-05-30T10:37:04Z")

</div>

Thanks for your help  
using `sudo netstat -tunlp` I see this port mapping

```auto
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:9000 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:12201 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5100 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5101 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5102 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5103 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5108 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5045 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5046 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5047 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:1015 0.0.0.0:* LISTEN 475/java
tcp 0 0 0.0.0.0:5054 0.0.0.0:* LISTEN 475/java
udp 0 0 0.0.0.0:2055 0.0.0.0:* 475/java
udp 0 0 0.0.0.0:5308 0.0.0.0:* 475/java

```

I think that 5044 present on this list means that graylog start the input correctly. Fr this reason I test the telnent command and send message on it.  
It works fine

So, it seems a UI problem because the nput was installed correclty and should work fine. The problem is the GUI error after content pack import.

If I delete the input, restart graylog and create the same input manually it works fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 13, 2022, 10:37am UTC](https://community.graylog.org/t/input-with-contentpack-import/24067/4 "2022-06-13T10:37:21Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.