Logstash 6.0 beta-1 can't work with IBM JRE 8 due to old JRuby OpenSSL

Elastic Stack Logstash
1

I installed Logstash 5.5.1, 5.5.2 and even 6.0-beta1 bundled with another third party plugin to work with IBM JRE 8. The error "no cipher match" is thrown into logstash-plain.log. Per some deep investigation, this issue is relevant to JRuby-OpenSSL lib packaged with JRuby shipped with Logstash. Luckily, that issue (https://github.com/jruby/jruby/issues/4679) has been fixed in JRuby-OpenSSL 0.9.21, but Logstash was still delivered with old JRuby with old JRuby-OpenSSL version lower than 0.9.21. I checked Logstash 6.0-beta1, it includes Ruby-OpenSSL 0.9.20 gem.

For Logstash 6.0-beta1, the log stack trace is here.

All hosts unavailable, sleeping {:hosts=>["xx.xx.xx.xx"], :e=>#<OpenSSL::SSL::SSLError: no cipher match>, :backtrace=>["org/jruby/ext/openssl/SSLContext.java:506:in ciphers='", "org/jruby/ext/openssl/SSLContext.java:560:inset_params'", "/usr/share/logstash/logstash-core/lib/logstash/patches/stronger_openssl_defaults.rb:18:in new'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/mtlumberjack/client.rb:215:inblock in connect'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/mtlumberjack/client.rb:154:inconnect'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/mtlumberjack/client.rb:125:in initialize'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/mtlumberjack/client.rb:76:inconnect'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/mtlumberjack/client.rb:67:in initialize'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/logstash/outputs/mtlumberjack.rb:143:inconnect'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/logstash/outputs/mtlumberjack.rb:72:in block in register'", "org/jruby/RubyRange.java:485:ineach'", "/usr/share/logstash/vendor/local_gems/dee1aeb2/logstash-output-mtlumberjack/lib/logstash/outputs/mtlumberjack.rb:71:in register'", "org/jruby/RubyArray.java:1734:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/legacy.rb:17:in register'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:41:inregister'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:376:in register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:387:inblock in register_plugins'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:387:inregister_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:396:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:321:inrun'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:281:in `block in start'"]}

Is it possible for you to upgrade JRuby with 0.9.21 JRuby-OpenSSL inside Logstash 6.0?

2

This change you are requesting made it into JRuby 9.1.13.0, which should be incorporated into Logstash soon, as we need this version to address JRuby 9000 instabilities we encountered during testing.

Whether or not it makes it into the Logstash 6 release is still a matter of continued testing. It is certain, though, that we cannot use 9.1.12.0. We're still trying to determine whether we'll be able to move forward with 9.1.13.0.

1 Like
3

Aaron,

Thanks for your response. Looking forwarding to your support!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.