# A plugin had an unrecoverable error1 5.6.8

**URL:** <https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702>\
**Category:** Logstash\
**Created:** [March 13, 2018, 9:21am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702 "2018-03-13T09:21:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![liyongbin0419](https://avatars.discourse-cdn.com/v4/letter/l/8491ac/32.png) [@liyongbin0419](https://discuss.elastic.co/u/liyongbin0419)\
**Post date:** [March 13, 2018, 9:21am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702/1 "2018-03-13T09:21:44Z")

</div>

hi  
i ha ve a problem when i run logstash5.6.8version ,i cant slove.  
this is my configure  
error:  
Error: Permission denied  
[2018-03-13T16:52:47,053][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Tcp port=\>810, type=\>"huosusdklog", host=\>"172.16.15.19", id=\>"229060643949c25879b43fc13c94ccdbf01f5414-13", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Line id=\>"line\_01b5ed6d-1b2b-4cd2-ada9-cbba17195489", enable\_metric=\>true, charset=\>"UTF-8", delimiter=\>"\n"\>, data\_timeout=\>-1, mode=\>"server", proxy\_protocol=\>false, ssl\_enable=\>false, ssl\_verify=\>true, ssl\_key\_passphrase=\>\>  
Error: Permission denied  
[2018-03-13T16:52:47,053][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Tcp port=\>809, type=\>"bilog", host=\>"172.16.15.19", codec=\>\<LogStash::Codecs::JSON id=\>"json\_c6e6bb25-d2a9-4104-a212-4c92e48b3f98", enable\_metric=\>true, charset=\>"UTF-8"\>, id=\>"229060643949c25879b43fc13c94ccdbf01f5414-12", enable\_metric=\>true, data\_timeout=\>-1, mode=\>"server", proxy\_protocol=\>false, ssl\_enable=\>false, ssl\_verify=\>true, ssl\_key\_passphrase=\>\>  
Error: Permission denied  
[2018-03-13T16:52:47,053][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Tcp port=\>802, type=\>"php\_err", host=\>"172.16.15.19", id=\>"229060643949c25879b43fc13c94ccdbf01f5414-3", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Line id=\>"line\_91acd361-2007-45ca-bc12-fa9988fa95d0", enable\_metric=\>true, charset=\>"UTF-8", delimiter=\>"\n"\>, data\_timeout=\>-1, mode=\>"server", proxy\_protocol=\>false, ssl\_enable=\>false, ssl\_verify=\>true, ssl\_key\_passphrase=\>\>  
Error: Permission denied

input {  
tcp {  
port =\> 800  
type =\> business  
host =\> "172.16.15.19"  
}

tcp {  
port =\> 801  
type =\> nginx\_log  
host =\> "172.16.15.19"  
}

tcp {  
port =\> 802  
type =\> php\_err  
host =\> "172.16.15.19"  
}

tcp {  
port =\> 803  
type =\> php\_slow  
host =\> "172.16.15.19"  
}

tcp {  
port =\> 804  
type =\> ali\_cdn  
host =\> "172.16.15.19"  
codec =\> plain{ charset =\> "CP936" }  
}

..................  
}

tcp{  
port =\> 808  
type =\> inter\_flow  
host =\> "172.16.15.19  
}

beats {  
host =\> "120.25.167.206"  
port =\> 811  
}  
}

filter {  
if [type] == "business"{  
ruby {  
init =\> "@kname = ['hostname','log\_name','log\_timestamp','log\_level','event']"  
code =\> "new\_event = LogStash::Event.new(Hash[@kname.zip(event['message'].split('#'))]); new\_event.remove('@timestamp');event.append(new\_event)"  
remove\_field =\> ["message","@version","host"]  
}  
date {  
match =\> ["log\_timestamp" , "ISO8601"]  
}  
}

if [type] == "nginx\_log"{  
grok {  
match =\> { "message" =\> "(?:%{NOTSPACE:remote\_addr}|-) - (?:%{USER:user}|-) [%{HTTPDATE:log\_timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:status} (?:%{NUMBER:body\_bytes\_sent}|-) %{QS:referrer}%{QS:agent} (?:%{IP3:http\_x\_forwarded\_for}|%{IP2:http\_x\_forwarded\_for}|%{IP:http\_x\_forwarded\_for}|-) %{NOTSPACE:http\_head} %{NOTSPACE:hostname} %{NOTSPACE:upstream\_response\_time} %{NUMBER:request\_time} %{NOTSPACE:post\_part}" }

```
  match => { "message" => "(?:%{NOTSPACE:remote_addr}|-) - (?:%{USER:user}|-) \[%{HTTPDATE:log_timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:status} (?:%{NUMBER:body_bytes_sent}|-) %{QS:referrer}%{QS:agent} (?:%{IP3:http_x_forwarded_for}|%{IP2:http_x_forwarded_for}|%{IP:http_x_forwarded_for}|-) %{NOTSPACE:http_head} %{NOTSPACE:hostname} %{NOTSPACE:upstream_response_time} %{NUMBER:request_time}" }
}
if [request] {
ruby {
  init => "@kname = ['uri','url_args']"
  code => "new_event = LogStash::Event.new(Hash[@kname.zip(event['request'].split('?'))]); new_event.remove('@timestamp');event.append(new_event)"
  remove_field => ["request","message","@version","host","user"]
    }
}
date { match => ["log_timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] }
mutate {
  convert => [
  "status" , "integer",
  "body_bytes_sent" , "integer",
  "request_time", "float",
  "upstream_response_time", "float"
  ]
}
date {
  match => ["timestamp" , "ISO8601"]
}
mutate { gsub => ["post_part", "password=[^&]+", "password=@@@@@@@" ] }

```

}

if [type] == "command" {  
grok {  
match =\> {"message" =\> "%{GREEDYDATA:xx}: : %{TIMESTAMP\_ISO8601:log\_timestamp} %{NOTSPACE:hostname} %{USERNAME:user}@%{NOTSPACE:tty} %{IPV4:chient\_ip} %{NUMBER:client\_port} %{IPV4:server\_ip} %{NUMBER:server\_port} %{GREEDYDATA:command}"}  
remove\_field =\> ['message','port','host','@version','xx','tags']  
}  
grok {  
match =\> {"message" =\> "%{GREEDYDATA:xx}: : %{TIMESTAMP\_ISO8601:log\_timestamp} %{NOTSPACE:hostname} %{USERNAME:user}@\s+%{GREEDYDATA:command}"}  
remove\_field =\> ['message','port','host','@version','xx','tags']  
}  
date { match =\> ["log\_timestamp" , "yyyy-MM-dd HH:mm:ss"] }  
}

if [type] == "renyun"{  
ruby {  
init =\> "@kname = ['hostname','file\_path','msg']"  
code =\> "new\_event = LogStash::Event.new(Hash[@kname.zip(event['message'].split('#'))]); new\_event.remove('@timestamp');event.append(new\_event)"  
remove\_field =\> ["port","message","@version","host"]  
}  
}

if [type] == "inter\_flow" {  
grok {  
match =\> { "message" =\> "%{NOTSPACE:hostname} %{TIMESTAMP\_ISO8601:log\_timestamp} %{IP:eth0\_ip} %{NUMBER:eth0\_in} %{NUMBER:eth0\_out} %{IP:eth1\_ip} %{NUMBER:eth1\_in} %{NUMBER:eth1\_out}" }  
remove\_field =\> ["message","@version","host"]  
}  
mutate {  
convert =\> [  
"eth0\_in" , "integer",  
"eth0\_out" , "integer",  
"eth1\_in", "integer",  
"eth1\_out", "integer"  
]  
}  
date {  
match =\> ["log\_timestamp" , "yyyy-MM-dd HH:mm:ss"]  
}  
}

.......

}

anyone have idea how to slove this error

---

<div class="post-metadata">

**Author:** ![liyongbin0419](https://avatars.discourse-cdn.com/v4/letter/l/8491ac/32.png) [@liyongbin0419](https://discuss.elastic.co/u/liyongbin0419)\
**Post date:** [March 13, 2018, 9:23am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702/2 "2018-03-13T09:23:55Z")

</div>

becauser the character is too long . so i delete some

---

<div class="post-metadata">

**Author:** ![liyongbin0419](https://avatars.discourse-cdn.com/v4/letter/l/8491ac/32.png) [@liyongbin0419](https://discuss.elastic.co/u/liyongbin0419)\
**Post date:** [March 13, 2018, 9:24am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702/3 "2018-03-13T09:24:58Z")

</div>

this is output

output {  
if [type] == "nginx\_log" {  
elasticsearch {  
hosts =\> "172.16.15.19:9200"  
index =\> "logstash-nginx-%{+YYYY-MM-dd}"  
user =\> "elastic"  
password =\> "changeme"  
}  
}

if [type] == "business" {  
elasticsearch {  
hosts =\> "172.16.15.19:9200"  
index =\> "logstash-business-%{+YYYY-MM-dd}"  
user =\> "elastic"  
password =\> "changeme"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2018, 9:24am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error1-5-6-8/123702/4 "2018-04-10T09:24:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.