# Logstash v2.1.3: A plugin had an unrecoverable error

**URL:** <https://discuss.elastic.co/t/logstash-v2-1-3-a-plugin-had-an-unrecoverable-error/53590>\
**Category:** Logstash\
**Created:** [June 22, 2016, 12:37am UTC](https://discuss.elastic.co/t/logstash-v2-1-3-a-plugin-had-an-unrecoverable-error/53590 "2016-06-22T00:37:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\
**Post date:** [June 22, 2016, 12:37am UTC](https://discuss.elastic.co/t/logstash-v2-1-3-a-plugin-had-an-unrecoverable-error/53590/1 "2016-06-22T00:37:27Z")

</div>

Hi,  
I push windows eventlog using winlogbeat-dev(Version: 5.0.0-nightly2bfc1c4) to logstash v2.1.3,the logstash configuration is

input{  
beats {  
add\_field =\>["itcategory","it\_security\_windowslog"]  
port =\> 5150  
}  
}  
(no filter)

output{  
elasticsearch {  
hosts =\> "localhost"  
index =\> "it\_security\_windowslog-%{+YYYY.MM.dd}"  
document\_type =\> "windowslog"  
}  
}  
}

but sometimes ,logstash crashed, logstash.err shows :  
(I have increased the logstash memory from 500MB to 2048MB,no effect)

Error: Your application used more memory than the safety cap of 2048M.  
Specify -J-Xmx####m to increase it (#### = cap size in MB).  
Specify -w for full OutOfMemoryError stack trace

logstash.log shows:  
{:timestamp=\>"2016-06-22T07:35:04.563000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_security\_windowslog"}, port=\>5150, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-22T07:35:05.566000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_security\_windowslog"}, port=\>5150, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-22T07:35:06.568000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_security\_windowslog"}, port=\>5150, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-22T07:35:07.571000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_security\_windowslog"}, port=\>5150, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}

anybody could help me? thanks.

---

<div class="post-metadata">

**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\
**Post date:** [June 23, 2016, 1:01am UTC](https://discuss.elastic.co/t/logstash-v2-1-3-a-plugin-had-an-unrecoverable-error/53590/2 "2016-06-23T01:01:41Z")

</div>

Append:  
there are other warning log in logsash before crash(A plugin had an unrecoverable error):

{:timestamp=\>"2016-06-23T06:32:03.049000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:23357", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T06:43:36.955000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:40070", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T06:49:30.620000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:61223", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T06:55:22.942000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:6350", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T06:57:53.266000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:50935", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T06:58:13.399000+0800", :message=\>"Beats Input: Remote connection closed", :peer=\>"10.42.31.8:5069", :exception=\>#\<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Errno::ECONNRESET, Connection reset by peer - Connection reset by peer\>, :level=\>:warn}  
{:timestamp=\>"2016-06-23T07:00:32.039000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_p3sfcs\_windowslog"}, port=\>5159, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-23T07:00:33.042000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_p3sfcs\_windowslog"}, port=\>5159, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-23T07:00:34.045000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_p3sfcs\_windowslog"}, port=\>5159, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}  
{:timestamp=\>"2016-06-23T07:00:35.048000+0800", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::Beats add\_field=\>{"itcategory"=\>"it\_p3sfcs\_windowslog"}, port=\>5159, codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message"\>\n Error: unable to create new native thread", :level=\>:error}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/logstash-v2-1-3-a-plugin-had-an-unrecoverable-error/53590/3 "2017-07-06T04:51:03Z")

</div>