# Logstash8.12.2 restart many times may encounter plugin load errors 'cabin/metrics','cabin/log/logger', "logstash::codecs::multiline::grok" **URL:** \ **Category:** Elasticsearch\ **Created:** [March 12, 2024, 6:06am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206 "2024-03-12T06:06:21Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 12, 2024, 6:06am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/1 "2024-03-12T06:06:21Z")
I upgrade the logstash from 7.16.3 to 8.12.2 and it can start up successfully after the configuration file adjustment, but if I restart the logstash service time from times it may encounter above plugin load errors. Can anybody help me on this? Is this caused by the unstable of logstash8.12.2 or something else? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 12, 2024, 7:09am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/2 "2024-03-12T07:09:23Z")
Welcome to the community Have you changed .conf or logstash.yml Have you used .tar version or installation package .rpm? Can you provide more details? LS 8.12.2 works fine. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 13, 2024, 11:53am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/6 "2024-03-13T11:53:21Z")
Please do not post pictures. It might be related to JDK, but not sure. Please provide more details. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 21, 2024, 12:23pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/10 "2024-03-21T12:23:21Z")
There is something wrong with a grok pattern separated in a file. Either path or permissions have an issue. ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 21, 2024, 3:20pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/11 "2024-03-21T15:20:10Z")
Q: 1. if it's related to the grok pattern then why when we use ls 7.16.3 it works well in our production environment ? 2. 2.if it's related to path then why some times the startup will succeed without any error log 3. 1. same to above two questions ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 21, 2024, 3:21pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/12 "2024-03-21T15:21:48Z")
by the way, the user and the group is default to logstash ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 21, 2024, 8:44pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/13 "2024-03-21T20:44:50Z")
1. No sure, however there is the trace in the log: add\_patterns\_from\_file. 2. Restart after some time might be because: - damaged installation package - in that case, reinstall - memory or some other nonELK issues Check journalctl, is there some issues 1. Yes can be, because some params has been changed. You have set: ```auto output{ if [myTYpe] in ["my-type"] { elasticsearch { hosts => ["https://localhost:9200"] # has the cert issued on "localhost" or hostname, must be correct ssl_enabled => true ssl_certificate_authorities => "/etc/logstash/config/certs/ca.crt" # not as you set ssl_certificate_authoritiesE ssl_verification_mode => "full" # try also with none } } } ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 22, 2024, 2:01am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/16 "2024-03-22T02:01:57Z")
It's a waste of time to guess. Please provide a sample of message and your .conf file. ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 22, 2024, 2:07am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/18 "2024-03-22T02:07:24Z")
> [@LiYuzhuo2020](#): > > hing ruined in the version I installed, but I tried re-download from logstash website and re-install all doesn't help. I checked this from logstash github found this part of module is comming from ruby ... maybe there's something wrong with the ruby version ? require "cabin/namespace" require "cabin/timer" module Cabin::Mixins::Timer # Start timing something. # Returns an instance of Cabin::Timer bound to this Cabin::Channel. # To stop the timer and immediately emit the result to this channel, invoke # the Cabin::Timer#stop method. def time(data, &block) # TODO(sissel): need to refactor string-\>hash shoving. data = dataify(data) ``` timer = Cabin::Timer.new do |duration| data[:duration] = duration publish(data) end if block_given? block.call return timer.stop else return timer end ``` end # def time end # module Cabin::Mixins::Timer > ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 22, 2024, 2:09am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/19 "2024-03-22T02:09:02Z")
there must be some plugin try to require this module but failed ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 22, 2024, 2:16am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/20 "2024-03-22T02:16:34Z")
> [@LiYuzhuo2020](#): > > codec =\>multiline { > > ```auto > pattern => "^%{TIMESTAMP_ISO8601}" > negate => true > what => "previous" > > ``` > > } that cabin/mixins/timer plugin load error might happened in this part codec =\>multiline { ```auto pattern => "^%{TIMESTAMP_ISO8601}" negate => true what => "previous" ``` } ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 22, 2024, 3:11am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/21 "2024-03-22T03:11:43Z")
You need to provide a sample message and your logstash configuration so people can try to replicate your error, without this information it is just guessing and there is not much to do to help you. ---
**Author:** ![skitidal](https://avatars.discourse-cdn.com/v4/letter/s/9fc29f/32.png) [@skitidal](https://discuss.elastic.co/u/skitidal)\ **Post date:** [March 22, 2024, 2:00pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/22 "2024-03-22T14:00:41Z")
There is something wrong with a grok pattern separated in a file. ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 22, 2024, 2:37pm UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/23 "2024-03-22T14:37:48Z")
I comment out other pipeline and start one by one there's no error no matter how many times I restart but if I include a special pipeline the other pipeline will have the plugin load error, when I comment out that special pipeline it all works fine, I'm just confused with this why that special pipeline start speparately is ok but if start at the same time with other pipeline will cause other pipeline failed to startup ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 25, 2024, 2:08am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/24 "2024-03-25T02:08:51Z")
Thanks everyone problem resolved, it's due to one of my pipleline conf timestamp match error ---
**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Post date:** [March 27, 2024, 9:31am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/25 "2024-03-27T09:31:40Z")
o gosh I really don't know why mutate rename would cause string index out of range -1 exception ...... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2024, 9:32am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206/26 "2024-04-24T09:32:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.