# Logstash.pipeline error: A plugin had an unrecoverable error

**URL:** <https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228>\
**Category:** Logstash\
**Created:** [March 2, 2017, 10:20pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228 "2017-03-02T22:20:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\
**Post date:** [March 2, 2017, 10:20pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228/1 "2017-03-02T22:20:24Z")

</div>

I am setting up a demo for our CEO to review - Kibana dasboard. I have this installed on a local server and have filebeat installed on that elk server to create logs for the Kibana demo. It was working yesterday and I have no idea how I broke it. Below is a piece of my logstash-plain.log log file

[2017-03-02T16:08:08,201][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Plugin: \<LogStash::Inputs::Beats port=\>5044, id=\>"ad95fb8dc209078ce919ded5711317eda5c48b1e-1", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Plain id=\>"plain\_1c3bc15e-a81a-4dd1-8d23-b489985d00ab", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, ssl\_verify\_mode=\>"none", include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message", tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60\>  
Error: event executor terminated

Below is my filebeat yml - setup to run on same box as elk server to demo logs

## filebeat: prospectors: - paths: #- /var/log/_.log - /var/log/syslog - /var/log/apache2/_.log # NEW! input\_type: log registry\_file: /var/lib/filebeat/registry output: logstash: # not "elasticsearch"! hosts: ["localhost:5044"] # change to your hostname, note change of port shipper: logging: files:

this shows listener is running on 5044

netstat -l | grep 5044  
tcp6 0 0 [::]:5044 [::]:\* LISTEN

---------- piece from filebeat log

2017-03-02T16:17:59-06:00 ERR Failed to publish events caused by: read tcp 127.0.0.1:33882-\>127.0.0.1:5044: read: connection reset by peer  
2017-03-02T16:17:59-06:00 INFO Error publishing events (retrying): read tcp 127.0.0.1:33882-\>127.0.0.1:5044: read: connection reset by peer  
2017-03-02T16:18:22-06:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.write\_bytes=235 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.published\_but\_not\_acked\_events=2038

---

<div class="post-metadata">

**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\
**Post date:** [March 2, 2017, 10:34pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228/2 "2017-03-02T22:34:56Z")

</div>

here is output from elasticsearch for filebeat output  
curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)'

-- only shows data from yesterday and not today

{  
"took" : 88,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 5,  
"successful" : 5,  
"failed" : 0  
},  
"hits" : {  
"total" : 37867,  
"max\_score" : 1.0,  
"hits" : [  
{  
"\_index" : "filebeat-2017.03.01",

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 3, 2017, 4:54pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228/3 "2017-03-03T16:54:26Z")

</div>

I've never seen this error. Moving to Logstash forum. Maybe someone more experience with Logstash has some idea.

---

<div class="post-metadata">

**Author:** ![wmstein](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wmstein](https://discuss.elastic.co/u/wmstein)\
**Post date:** [March 3, 2017, 6:00pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228/4 "2017-03-03T18:00:04Z")

</div>

I figured out the issue. The ip in logstash config was my domain name  
and the ip in filebeat.yml was localhost.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2017, 6:00pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228/5 "2017-03-31T18:00:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.