# 部署使用logstash he filebeat. logstash 在启动后使用-f参数 验证配置文件会报ERROR\] 2019-01-18 15:56:15.414 \[\[main\]\<beats\] pipeline - A plugin had an unrecoverable error. Will restart this plugin. 端口被占用，但不影响正常的使用 ，就是查看不到过滤后的日志输出。 使用ps -axf|grep logstash 是启动了一个服务 下边是日志 和输出的错误

**URL:** https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 18, 2019, 8:17am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751 "2019-01-18T08:17:21Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![tian](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tian](https://discuss.elastic.co/u/tian)
#### Post date: [January 18, 2019, 8:17am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/1 "2019-01-18T08:17:21Z")

</div>

C[root@ conf.d]# /usr/share/logstash/bin/logstash -f nginx.conf  
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Coefaults  
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console  
[WARN] 2019-01-18 15:56:02.837 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[INFO] 2019-01-18 15:56:03.258 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.3.2"}  
[INFO] 2019-01-18 15:56:07.855 [Converge PipelineAction::Create] pipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pip25, "pipeline.batch.delay"=\>50}  
[INFO] 2019-01-18 15:56:08.246 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://ela124.5:9200/](http://ela124.5:9200/)]}}  
[INFO] 2019-01-18 15:56:08.259 [[main]-pipeline-manager] elasticsearch - Running health check to see if an Elasticsearch connection is working {:healtlastic:xxxxxx@192.168.124.5:9200/, :path=\>"/"}  
[WARN] 2019-01-18 15:56:08.446 [[main]-pipeline-manager] elasticsearch - Restored connection to ES instance {:url=\>"[http://elastic:xxxxxx@192.168.124](http://elastic:xxxxxx@192.168.124).  
[INFO] 2019-01-18 15:56:08.628 [[main]-pipeline-manager] elasticsearch - ES Output version determined {:es\_version=\>6}  
[WARN] 2019-01-18 15:56:08.630 [[main]-pipeline-manager] elasticsearch - Detected a 6.x and above cluster: the `type` event field won't be used to det\_type {:es\_version=\>6}  
[INFO] 2019-01-18 15:56:08.651 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=4.5:9200"]}  
[INFO] 2019-01-18 15:56:08.663 [Ruby-0-Thread-5: :1] elasticsearch - Using mapping template from {:path=\>nil}  
[INFO] 2019-01-18 15:56:08.675 [Ruby-0-Thread-5: :1] elasticsearch - Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "verngs"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_typng"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>trip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[INFO] 2019-01-18 15:56:08.783 [[main]-pipeline-manager] geoip - Using geoip database {:path=\>"/opt/GeoLite2-City.mmdb"}  
[INFO] 2019-01-18 15:56:09.073 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:8092"}  
[INFO] 2019-01-18 15:56:09.091 [Converge PipelineAction::Create] pipeline - Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thr}  
[INFO] 2019-01-18 15:56:09.143 [[main]\<beats] Server - Starting server on port: 8092  
[INFO] 2019-01-18 15:56:09.151 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=\>1, :running\_pion\_running\_pipelines=\>}  
[INFO] 2019-01-18 15:56:09.333 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9601}  
[ERROR] 2019-01-18 15:56:15.414 [[main]\<beats] pipeline - A plugin had an unrecoverable error. Will restart this plugin.  
Pipeline\_id:main  
Plugin: \<LogStash::Inputs::Beats port=\>8092, id=\>"95e40e780d0bff40c5d1874ebdff7e398d9a1c919858f8cabeb734a31bd694b1", enable\_metric=\>true, codec=\>\<Log id=\>"plain\_88a68485-03d6-4de7-a3aa-c2f8578876a7", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, ssl\_verify\_mode=\>"none", includsl\_handshake\_timeout=\>10000, tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_A"TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_S\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60, executor\_threads=\>8\>  
Error: Address already in use  
Exception: Java::JavaNet::BindException  
Stack: sun.nio.ch.Net.bind0(Native Method)  
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:433)  
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:425)  
sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:223)  
io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:128)  
io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:558)  
io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1283)  
io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:501)  
io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:486)  
io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:989)  
io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:254)  
io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:364)

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 18, 2019, 8:37pm UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/2 "2019-01-18T20:37:05Z")

</div>

Is there a question you have?

---

<div class="post-metadata">

### Author: ![tian](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tian](https://discuss.elastic.co/u/tian)
#### Post date: [January 21, 2019, 5:32am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/3 "2019-01-21T05:32:56Z")

</div>

Error: Address already in use What is the reason?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 21, 2019, 6:33am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/4 "2019-01-21T06:33:12Z")

</div>

That would suggest that another process is already using that IP and port. Are you sure there isn't another Elasticsearch running?

---

<div class="post-metadata">

### Author: ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)
#### Post date: [January 21, 2019, 7:38am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/5 "2019-01-21T07:38:24Z")

</div>

> [@tian](#):
>
> Address already in us

Address already in us  
change the port of logstash

---

<div class="post-metadata">

### Author: ![tian](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tian](https://discuss.elastic.co/u/tian)
#### Post date: [January 28, 2019, 3:02am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/6 "2019-01-28T03:02:33Z")

</div>

happy new year

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2019, 3:02am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751/7 "2019-02-25T03:02:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.