# Logstash plugin had an unrecoverable error. Will restart this plugin **URL:** \ **Category:** Logstash\ **Created:** [February 22, 2023, 7:57pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220 "2023-02-22T19:57:26Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Vinicius\_Carmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinicius_carmo/32/117599_2.png) [@Vinicius\_Carmo](https://discuss.elastic.co/u/Vinicius_Carmo)\ **Post date:** [February 22, 2023, 7:57pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/1 "2023-02-22T19:57:26Z")
Hello everyone, I need help I tried using the Microsoft-sentinel plugin output logstash. but I get an error: A plugin had an unrecoverable error. Will restart this plugin Error: address already in use I used two output plugins, one is the log analytics plugin, this one is working correctly, but the new plugin doesn't work. I just checked another instance of logstash but I don't have My file conf ```auto input { tcp { port => 30050 codec => "json" tags => "app1" } beats { port => 5044 tags => "app2" } } filter { if "GC(" in [message] { drop { } } } output { if "app1" in [tags]{ microsoft-logstash-output-azure-loganalytics { workspace_id => "xxxxxxxxxxxxxxxxxxxxxx" workspace_key => "xxxxxxxxxxxxxxxxxxxxxx" custom_log_table_name => "app1" } } else if "app2" in [tags] { microsoft-sentinel-logstash-output-plugin{ client_app_Id => "aaaaaaaaaaaaaaa" client_app_secret => "bbbbbbbbbbbbbbbbb" tenant_id => "1234567" data_collection_endpoint => "https://dce-endpoint" dcr_immutable_id => "dcr-asdasdsad" dcr_stream_name => "Custom-app2_CL" create_sample_file=> false sample_file_path => "c:\\temp" } } } ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 22, 2023, 8:06pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/2 "2023-02-22T20:06:46Z")
> [@Vinicius\_Carmo](#): > > A plugin had an unrecoverable error. Will restart this plugin > Error: address already in use Please share the log error from Logstash, it is not possible to know what could be the issue without the error log. ---
**Author:** ![Vinicius\_Carmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinicius_carmo/32/117599_2.png) [@Vinicius\_Carmo](https://discuss.elastic.co/u/Vinicius_Carmo)\ **Post date:** [February 22, 2023, 8:30pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/3 "2023-02-22T20:30:36Z")
Thanks, Leandrojmp. Send ```auto [2023-02-22T09:13:57,765][INFO][logstash.outputs.azureloganalytics][main] Successfully posted 4 logs into custom log analytics table[appp1]. [2023-02-22T09:13:59,648][ERROR][logstash.javapipeline][main][684df08e40d65f75cbbc97ad9dd92eab16204f5016236bbea358aa5b6c8c6602] A plugin had an unrecoverable error. Will restart this plugin. Pipeline_id:main Plugin: 5044, tags=>["app2"], id=>"21qwddasdsadasd", enable_metric=>true, codec=>"plain_easdasdsadsada", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, ssl_cipher_suites=>["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], ssl_supported_protocols=>["TLSv1.2", "TLSv1.3"], client_inactivity_timeout=>60, executor_threads=>2, add_hostname=>false, tls_min_version=>1, tls_max_version=>1.3> Error: Address already in use Exception: Java::JavaNet::BindException there's just one service using the port 5044 [root@CLP1234563 logstash]# netstat -an | grep 5044 tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN tcp 0 0 12.2.2.2:5044 1.1.1.1:53870 ESTABLISHED [root@CLP123456 logstash]# netstat -tulpn | grep 5044 tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN 6001/java [root@CLP123456 logstash]# ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 22, 2023, 8:33pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/4 "2023-02-22T20:33:46Z")
Your issue is not with the output plugins, but with an input plugin. Logstash could not bind the `5044` because something else was already using it. How are you running logstash? Are you using `pipelines.yml`? ---
**Author:** ![Vinicius\_Carmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinicius_carmo/32/117599_2.png) [@Vinicius\_Carmo](https://discuss.elastic.co/u/Vinicius_Carmo)\ **Post date:** [February 22, 2023, 9:49pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/5 "2023-02-22T21:49:17Z")
Thanks Leandro. I execute bin/logstash - f /etc/logstash/conf.g/logstash.conf In pipelines.yml there are only one path.config ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 22, 2023, 10:02pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/6 "2023-02-22T22:02:26Z")
> [@Vinicius\_Carmo](#): > > I execute bin/logstash - f /etc/logstash/conf.g/logstash.conf So, you do not use Logstash as a service with `systemctl`? Are you sure that you do not have another instance running? The error you got was pretty clear, some process in your system was already using the port `5044`, the process with the pid `6001`, there is not much to it, if this is not a Logstash, you need to check in your system what is listening on port `5044`. ---
**Author:** ![Vinicius\_Carmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinicius_carmo/32/117599_2.png) [@Vinicius\_Carmo](https://discuss.elastic.co/u/Vinicius_Carmo)\ **Post date:** [February 24, 2023, 12:39pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/7 "2023-02-24T12:39:56Z")
He leandrojmp Thank you for your help actually had 2 processes running logstash after killing a process the plugin worked ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 24, 2023, 12:40pm UTC](https://discuss.elastic.co/t/logstash-plugin-had-an-unrecoverable-error-will-restart-this-plugin/326220/8 "2023-03-24T12:40:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.