# Imap plugin crashes logstash when there are attachments **URL:** \ **Category:** Logstash\ **Created:** [May 27, 2015, 7:10pm UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420 "2015-05-27T19:10:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [May 27, 2015, 7:10pm UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/1 "2015-05-27T19:10:57Z")
My issue is the same as was reported about a year ago here: [https://logstash.jira.com/browse/LOGSTASH-2080](https://logstash.jira.com/browse/LOGSTASH-2080) logstash silently (other than the two below log entries) dies when it tries to read an e-mail with an attachment. {:timestamp=\>"2015-05-27T11:58:52.925000-0700", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \"mail", host=\>"redacted", user=\>"redacted", folder=\>"INBOX", content\_type=\>"text/plain"\>\n Error: Can not decode an entire message, try calling #decoded on the various fields and body or parts if it is a multipart message.", :level=\>:error} {:timestamp=\>"2015-05-27T11:58:55.792000-0700", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \"mail", host=\>"redacted", user=\>"redacted", folder=\>"INBOX", content\_type=\>"text/plain"\>\n Error: Can not decode an entire message, try calling #decoded on the various fields and body or parts if it is a multipart message.", :level=\>:error} Anyone have a work-around? ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [May 27, 2015, 7:40pm UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/2 "2015-05-27T19:40:34Z")
And I'm actually not sure it's a problem with an attachment - might just be a "large" message. It's difficult to tell which mail it's failing on. ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [June 5, 2015, 11:40pm UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/3 "2015-06-05T23:40:15Z")
I also see errors like the following that cause logstash to crash: {:timestamp=\>"2015-06-05T09:10:48.800000-0700", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \"mail", host=\>"redacted", user=\>"redacted", folder=\>"mail/dba-sqljobs", content\_type=\>"text/plain"\>\n Error: Bad file descriptor - Bad file descriptor", :level=\>:error} {:timestamp=\>"2015-06-05T10:59:06.962000-0700", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \"mail", host=\>"redacted", user=\>"redacted", folder=\>"mail/dba-sqljobs", content\_type=\>"text/plain"\>\n Error: Bad file descriptor - Bad file descriptor", :level=\>:error} And in both cases, it takes two to cause logstash to die but it seems they can be an arbitrary amount of time between them. ---
**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\ **Post date:** [October 26, 2015, 9:29am UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/4 "2015-10-26T09:29:26Z")
Hi, I have this problem with fresh installation. Do you know how I can solve this problem ? Thanks. ---
**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Post date:** [October 26, 2015, 9:46pm UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/5 "2015-10-26T21:46:06Z")
I didn't actually find a solution but my workaround is: 1. Try and avoid the e-mails with attachments that cause the crash - I moved the mails that I wanted to ingest to a separate imap folder while avoiding the mails that I know cause problems. I used imapfilter - [https://github.com/lefcha/imapfilter](https://github.com/lefcha/imapfilter) 2. I wrote a little cron script that detects when logstash crashes and restarts. Here's the script: #!/bin/sh ls\_status=`service logstash status` if ["x$ls\_status" != "xlogstash is running"] then service logstash start; echo "`date` - logstash not running - restarted" \>\> /tmp/logstash.log; fi Not pretty and don't think I'd use this for "production" but good enough for testing. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/imap-plugin-crashes-logstash-when-there-are-attachments/1420/6 "2017-07-06T05:25:21Z")