A plugin had an unrecoverable error LogStash::Inputs::Beats 5.2.1

Elastic Stack Logstash
1

Hi,

I am trying to start my Logstash config in one of my server. I am getting the following error which I couldn't figure out.

I am using Logstash and filebeat version 5.2.1. Filebeat is running on remote server.

Error

17:29:58.843 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
17:29:58.851 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
17:29:58.892 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
17:30:04.884 [[main]<beats] ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin.
  Plugin: <LogStash::Inputs::Beats port=>1020, id=>"c7308cb9c674f6bc45e6330c0595a1c9a82f5f55-1", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_5a5fde93-bf7d-46d2-b990-1b5dd8645ef5", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60>
  Error: Permission denied
17:30:07.907 [[main]<beats] ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin.
  Plugin: <LogStash::Inputs::Beats port=>1020, id=>"c7308cb9c674f6bc45e6330c0595a1c9a82f5f55-1", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_5a5fde93-bf7d-46d2-b990-1b5dd8645ef5", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60>
  Error: event executor terminated

Logstash.config

 input{beats { port => 1020}}
 filter{ }
 
 output{
 	if[type] == "obg"
 	 {
		elasticsearch {
 		# Index name is used to store the elasticsearch value and it will display the elasticsearch value in kibana using the index name
 			index => "logstash-obg-log"
		hosts => ["xx.xx.xxx:9200"]	
		document_id => "%{fingerprint}" # !!! prevent duplication
	}
	}

NOTE: One more Logstash instance is running on the same server with different port . I stopped that instance and tried to run the config above also I amgetting same error. please provide your thoughts on this.

1 Like
2

Unless you run Logstash as root or use a workaround like port forwarding you can't listen to a port <1024.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.