# Beats plugin will not start with "cipher not found" **URL:** \ **Category:** Logstash\ **Created:** [January 31, 2018, 8:53pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902 "2018-01-31T20:53:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![TimoHar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timohar/32/27257_2.png) [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Post date:** [January 31, 2018, 8:53pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902/1 "2018-01-31T20:53:21Z")
ES 6.1.1 Kibana 6.1.1 Beats 6.1.2 All on Ubuntu 16.0.4 LTS When upgrading Logstash from 5.6 to 6.1, I am unable to use SSL when defining the beats plugin, it complains that the cipher is not available, and Logstash will not start. I found and tried the solution in topic [https://discuss.elastic.co/t/problem-with-cipher-in-beat-input/67841](https://discuss.elastic.co/t/problem-with-cipher-in-beat-input/67841), which did not help. - mkdir /usr/share/logstash/tmp - chown logstash /usr/share/logstash/tmp - chgrp logstash /usr/share/logstash/tmp - chmod 0775 /usr/share/logstash/tmp - modifying jvm.options and specifying -Dio.netty.native.workdir=/usr/share/logstash/tmp I am using the Oracle JVM, and I found the solution in topic [Logstash TLS with x-pack error registering plugin (Cipher is not available) 6.x](https://discuss.elastic.co/t/logstash-tls-with-x-pack-error-registering-plugin-cipher-is-not-available-6-x/117650), which does not seem to be applicable - Logstash 5.6 has no problem with AES\_256 ciphers - I actually removed all ciphers _but_ AES\_256 to test this. All other inputs (non-SSL) instantiate fine, outputs to logstash Beats input stanza, (working fine in 5.6): > ``` > beats { > port => 5044 > ssl => true > ssl_certificate_authorities => ["/etc/ssl/xxx.pem"] > ssl_certificate => "/etc/ssl/xxx.xxx.xxx.pem" > ssl_key => "/etc/ssl/xxx.xxx.xxx.key" > ssl_verify_mode => "force_peer" > cipher_suites => ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"] > } > > ``` Error on Logstash 6.1.3: > [2018-01-30T18:45:23,753][ERROR][logstash.pipeline] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"\5044, ssl=\>true, ssl\_certificate\_authorities=\>["/etc/ssl/xxx.pem"], ssl\_certificate=\>"/etc/ssl/xxx.xxx.xxx.pem", ssl\_key=\>"/etc/ssl/xxx.xxx.xxx.key", ssl\_verify\_mode=\>"force\_peer", id=\>"a32f008bdfc78d72769ea669266b45cc0f21c19f4e18f292cf4b43882bca4436", enable\_metric=\>true, codec=\>\"plain\_fbd31f65-e1b7-47f1-86c2-7a3782720bd0", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60, executor\_threads=\>32\>", :error=\>"Cipher `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` is not available", :thread=\>"#\"} > [2018-01-30T18:45:32,661][WARN][logstash.runner] SIGTERM received. Shutting down the agent. > [2018-01-30T18:45:33,634][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/lib/logstash/inputs/beats.rb:170:in `create_server'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/lib/logstash/inputs/beats.rb:158:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:343:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:354:in `block in register\_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:354:in `register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:510:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:401:in `start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:288:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"], :thread=\>"#\"} > [2018-01-30T18:45:33,639][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: LogStash::PipelineAction::Create/pipeline\_id:main, action\_result: false", :backtrace=\>nil} Many thanks in advance for any assistance! ---
**Author:** ![TimoHar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timohar/32/27257_2.png) [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Post date:** [February 1, 2018, 2:37pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902/2 "2018-02-01T14:37:19Z")
Started logstash with debug logging. Grep for "netty" and found this: `[DEBUG][io.netty.util.internal.PlatformDependent] -Dio.netty.tmpdir: /tmp` Added this line to jvm.options (kept the workdir line from above) `-Dio.netty.tmpdir=/usr/share/logstash/tmp` and now got this in the debug log: ``` ... [DEBUG][io.netty.util.internal.PlatformDependent] -Dio.netty.tmpdir: /usr/share/logstash/tmp ... [DEBUG][io.netty.handler.ssl.OpenSsl] netty-tcnative not in the classpath; OpenSslEngine will be unavailable. ... ``` ---
**Author:** ![TimoHar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timohar/32/27257_2.png) [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Post date:** [February 1, 2018, 8:09pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902/3 "2018-02-01T20:09:44Z")
Ran `strace -Ff -tt bin/logstash -f /etc/logstash/conf.d/logstash.conf 2>&1 | tee strace-logstash.log` I'd post the 78MB file, but it's kinda long of note in the log, when running `grep "tcnative" strace-logstash.log` is that logstash finds and reads the tcnative jar ``` [pid 12803] 19:29:11.549241 stat("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", {st_mode=S_IFREG|0644, st_size=2766507, ...}) = 0 [pid 12803] 19:29:11.549605 stat("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", {st_mode=S_IFREG|0644, st_size=2766507, ...}) = 0 [pid 12803] 19:29:11.549801 stat("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", {st_mode=S_IFREG|0644, st_size=2766507, ...}) = 0 [pid 12803] 19:29:11.841321 stat("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", [pid 12803] 19:29:11.841418 stat("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", [pid 12803] 19:29:11.841510 open("/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-beats-5.0.6-java/vendor/jar-dependencies/io/netty/netty-tcnative-boringssl-static/2.0.7.Final/netty-tcnative-boringssl-static-2.0.7.Final.jar", O_RDONLY [pid 12803] 19:29:11.842145 <... read resumed> "-tcnative-boringssl-static/pom.p"..., 128) = 128 ``` Anybody? ---
**Author:** ![TimoHar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timohar/32/27257_2.png) [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Post date:** [February 2, 2018, 7:46pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902/4 "2018-02-02T19:46:01Z")
Performed bare-metal rebuild. Issue is gone. Unable to reproduce. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2018, 7:49pm UTC](https://discuss.elastic.co/t/beats-plugin-will-not-start-with-cipher-not-found/117902/5 "2018-03-02T19:49:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.