Logstash plugin install : Error socket closed

Elastic Stack Logstash
1

Hi ,

I want to install a Stormshield plugin for Logstash

I tried
bin/logstash-plugin install --no-verify logstash-filter-SNS

I have "ERROR : Something went wrong when installalling bin/logstash-filter-SNS , message socket closed

I tried to install plugin with offline method with gem build
gem build XXX.gemspec => work
But when I launch : bin/logstash-plugin install --no-verify XXX.gem
Same error : Socket closed

I tried to install by following the official doc and I have an URI error

Can you help me :slight_smile:

Thanks

2

No idea ?

I search a long and there are anothers with the same problem...

Nobody solved this ?

3

If your environment is using a proxy, must be set.
Set log.level to debug or trace should be some traces.

4

I don't have any proxy . How I can set log level ?
Thx

5

log.level: debug in logstash.yml, and restart LS.

Paste here, formated with </> button.

And ...Welcome to the community. :slightly_smiling_face:

6

I don't think that will work. logstash-plugin is interpreted Ruby code, and does not use log4j. But since it is interpreted Ruby you can just add puts calls wherever you want.

If you run DEBUG=1 bin/logstash-plugin install --no-verify logstash-filter-SNS you may get a few extra messages but I doubt it will help.

1 Like
7

Good point Badger. :+1:

I have googled about SNS plugin. This should be a syslog message, and there is LS configuration and github.

Might be not supported.

Supported version

  • Elasticsearch: 6.8.2
  • Kibana: 6.8.2
  • Logstash: 6.8.2
8

How I can add "puts calls" ?

I follow this Github for my plugins and when I read lsconfiguration ( Thx for the website) it's write that the logstash-plugins are required ....

Do I have to do the filter manually ? :thinking: :thinking: :thinking:

Have you got an another idea ?

Thx to Badger and Rios

9

Not sure is the plugin supported on 8.x platform. The release is for Logstash: 6.8.2.

I would:

  1. Try to install as Badger suggested, and figure out from LS logs or journalctl is there any possible trace, do not spend more then 1h hour on this since Badge is not optimistic.
  2. There is email contact for Labo SVC at the bottom of github link, you might ask for advice
  3. Make a test conf just with syslog input, without filtering to see will you receive messages.
    If is not working, which is possible, but maaaaaaybe LS 8.x has something improved in syslog plugin.

I personally didn't have experience with this quite specific plugin, not yet. However I can provide an advice. :slightly_smiling_face:

10

The code for the pluginmanager is in ${LOGSTASH_HOME}/lib/pluginmanager. It is .rb files that you can edit. It already has some puts calls. You can add more to try to follow the flow and see where the error is occuring. If you are not used to programming in ruby it will not be easy.

1 Like
11

Have you tried to install any other plugin?

The error you are getting seems to be network related, do you have any firewall in your network that could be blocking/limiting the connection?

1 Like
12

Leandro, I have already asked is there a proxy. No, there is no proxy. It's good idea to try with some other plugin just to test since this plugin is supported for 6.8.
If there is no internet connection, then will need to install in offline mode if is supported for this plugin.

13

I have a working Internet connection and I have the same error with offline install.

Can you give me an online plugin working with 8.6 ?

When I tested with list or update option , the result seems good..

I will test with a Vmware station and standard Internet connection too..

Lot off people have the same error and no solution

Thx a lot

14

It is not related to the version, the plugin installs fine in 8.6.2 for me.

$ bin/logstash --version;  bin/logstash-plugin install --no-verify logstash-filter-SNS
Using bundled JDK: /opt/logstash/jdk
logstash 8.6.2
Using bundled JDK: /opt/logstash/jdk
Installing logstash-filter-SNS
Installation successful

Can you share any post that you found in the forum about this issue?

1 Like
15

Thanks for your feedback
I will test with Vmware station ...

Some posts :

16

The issue of the error in your linked post is a network issue, the OP clearly specifies that he is on a corporate environment and probably has something interfering in its connnection.

I've made a recommendation in the same post to create a offline package on another machine.

Where are you trying to install it, are you in your home pc or are you in your work PC or a server in your company?

That's why I asked if you may have a firewall in your network that could be impacting your connection.

Keep in mind that you do not need to be using a proxy and can have a working internet connection and at the same time have a firewall in your network that could cause issues like this.

There is not much to troubleshoot, the socket closed error heavily suggests a network issue.

1 Like
17

My environment is a server behind a firewall with no proxy.

I don't have any logs on my firewall showing a blocked packet. However, I tested the installation with the offline method and I have the same problem.

That's why, I started to install Logstash Server on a Vmware station environment to test it, install the plugin with another connection and import it on my Vcenter.

I couldn't find any other solution...

The real question is: Why the same error with offline installation ?

18

How do you test it? For the offline method to work you need to have the desired plugin already installed, if you tried to create a offline package in the same machine where you can't install the package it won't work because you do not have the package in the machine.

You need to do this in a complete different machine where you are able to install the plugin, probably an machine outside your environment.

So you have a firewall in the end and even withtout a log showing a block this could be your issue.

For example, if your firewall is inspecting the ssl packages it may be opening the ssl connections and replacing the certificate, this could create an issue similar to yours.

You need to check with your network team.

19

For the offline method, I download the plugin, create a .gem with "gem build" and install it with logstash-plugin (offline method)

I checked the firewall and I unblocked the SSL inspection for the server...

However, it works with Vmstation, so I think Firewall PNAT is not compatible with the installation

I really appreciate your help

20

This is not how you create an offline package, you need to follow the documentation.

Basically you need to have the plugin installed on another logstash and use this logstash to generate the offline package.

Did you tried to install again after disabling SSL inspection?