title: Logstash udp input not working
body: <p>I am quite new to logstash but I've been spending quite some time in trying to get this right with no success. I am sending my logs from multiple applications on different server via udp to be logged.
  Here's the logstash configuration:</p>
  
  <pre><code>input{
    udp{
      port =&gt; 5960
      type =&gt; "log4net"
    }
  }
  filter {
    grok {
      match =&gt; ["message", "(?m)%{TIMESTAMP_ISO8601:sourceTimestamp}\s*%{WORD:System}\s*%{LOGLEVEL:logLevel}\s*-\s*%{WORD:logger}\s*-\s*%{NOTSPACE:source}\s*%{NOTSPACE:action}\s*%{UUID:transactionId}\s*%{GREEDYDATA:message}"]
    }
  }
  output {
    elasticsearch {
      protocol =&gt; "http"
      host =&gt; "[mylocalip]"
      port =&gt; "9200"
     }
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>Unfortunately no message is logged. I checked and made sure that the port is available when I start logstash. I also configured properly the firewall to allow udp message via this port. When I tcpdump I can see the udp messages arriving. Additionally I tried another method of input (logs from nginx) and it works ok.
  What am I doing wrong? <br/> ElasticSearch version-1.4<br/>Logstash version - 1.5 (initially tried also with 1.4)<br/> OS - CentOs 6.5 <br/>Java - OpenJDK Runtime Environment (rhel-2.5.5.1.el6_6-x86_64 u79-b14)</p>