# Logstash unhandled exception issue

**URL:** <https://discuss.elastic.co/t/logstash-unhandled-exception-issue/88725>\
**Category:** Logstash\
**Created:** [June 8, 2017, 2:45pm UTC](https://discuss.elastic.co/t/logstash-unhandled-exception-issue/88725 "2017-06-08T14:45:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![can.zhang](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@can.zhang](https://discuss.elastic.co/u/can.zhang)\
**Post date:** [June 8, 2017, 2:45pm UTC](https://discuss.elastic.co/t/logstash-unhandled-exception-issue/88725/1 "2017-06-08T14:45:25Z")

</div>

Does anyone have experience handle this issue?

The logstash error log like this.  
{:timestamp=\>"2017-06-08T14:09:18.074000+0000", :message=\>"Beats input: unhandled exception", :exception=\>#\<Zlib::BufError: buffer error\>, :backtrace=\>["org/jruby/ext/zlib/ZStream.java:134:in `finish'", "org/j ruby/ext/zlib/JZlibInflate.java:72:in`inflate'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:307:in `compressed_payload'", "/opt/ mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:178:in`feed'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-in  
put-beats-2.1.3/lib/lumberjack/beats/server.rb:311:in `compressed_payload'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:178:in`f  
eed'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:389:in `read_socket'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/ 1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:369:in`run'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats\_support/c  
onnection\_handler.rb:33:in `accept'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats.rb:177:in`handle\_new\_connection'", "/opt/mateinfo/ma  
intenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats\_support/circuit\_breaker.rb:42:in `execute'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gem s/logstash-input-beats-2.1.3/lib/logstash/inputs/beats.rb:177:in`handle\_new\_connection'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats.  
rb:133:in `run'"], :level=>:error} {:timestamp=>"2017-06-08T14:12:53.545000+0000", :message=>"Beats Input: Remote connection closed", :peer=>"172.2.1.234:49784", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats:: Connection::ConnectionClosed wrapping: Errno::EPIPE, Broken pipe - Broken pipe>, :level=>:warn} {:timestamp=>"2017-06-08T14:13:40.002000+0000", :message=>"Beats Input: Remote connection closed", :peer=>"172.2.1.50:54156", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::C onnection::ConnectionClosed wrapping: Errno::EPIPE, Broken pipe - Broken pipe>, :level=>:warn} {:timestamp=>"2017-06-08T14:13:44.588000+0000", :message=>"Beats Input: Remote connection closed", :peer=>"172.2.1.16:42040", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::C onnection::ConnectionClosed wrapping: Errno::EPIPE, Broken pipe - Broken pipe>, :level=>:warn} {:timestamp=>"2017-06-08T14:13:52.520000+0000", :message=>"Beats Input: Remote connection closed", :peer=>"172.2.0.150:36704", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats:: Connection::ConnectionClosed wrapping: Errno::EPIPE, Broken pipe - Broken pipe>, :level=>:warn} {:timestamp=>"2017-06-08T14:15:08.547000+0000", :message=>"Beats input: unhandled exception", :exception=>#<Zlib::BufError: buffer error>, :backtrace=>["org/jruby/ext/zlib/ZStream.java:134:in`finish'", "org/j  
ruby/ext/zlib/JZlibInflate.java:72:in `inflate'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:307:in`compressed\_payload'", "/opt/  
mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:178:in `feed'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-in put-beats-2.1.3/lib/lumberjack/beats/server.rb:311:in`compressed\_payload'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:178:in `f eed'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:389:in`read\_socket'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/  
1.9/gems/logstash-input-beats-2.1.3/lib/lumberjack/beats/server.rb:369:in `run'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats_support/c onnection_handler.rb:33:in`accept'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats.rb:177:in `handle_new_connection'", "/opt/mateinfo/ma intenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats_support/circuit_breaker.rb:42:in`execute'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gem  
s/logstash-input-beats-2.1.3/lib/logstash/inputs/beats.rb:177:in `handle_new_connection'", "/opt/mateinfo/maintenance/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.1.3/lib/logstash/inputs/beats. rb:133:in`run'"], :level=\>:error}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:45pm UTC](https://discuss.elastic.co/t/logstash-unhandled-exception-issue/88725/2 "2017-07-06T14:45:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.