Hi, I was doing the email input to logstash using plugin input imap.
[https://github.com/logstash-plugins/logstash-input-imap][1]
input {
imap {
type => mail
host => "imap.gmail.com"
user => "user.name"
password => "P@ssw0rd"
port => 993
}
}
filter {
if [type] == "mail" {
mutate {
remove_field => [ "received" ]
}
}
}
output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}
From the logstash.err
Jun 23, 2015 4:02:59 PM org.elasticsearch.node.internal.InternalNode <init>
INFO: [logstash-ELK-17245-12856] version[1.5.1], pid[17245], build[5e38401/2015-04-09T13:41:35Z]
Jun 23, 2015 4:02:59 PM org.elasticsearch.node.internal.InternalNode <init>
INFO: [logstash-ELK-17245-12856] initializing ...
Jun 23, 2015 4:02:59 PM org.elasticsearch.plugins.PluginsService <init>
INFO: [logstash-ELK-17245-12856] loaded [], sites []
IOError: closed stream
close at org/jruby/RubyIO.java:2098
teardown at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-imap-0.1.4/lib/logstash/inputs/imap.rb:147
inputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:203
synchronize at org/jruby/ext/thread/Mutex.java:149
inputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:203
start_input at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:171
From the logstash.log
{:timestamp=>"2015-06-23T16:03:04.823000+0800", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::IMAP type=>\"mail\", host=>\"imap.gmail.com\", user=>\"infra.gcp\", folder=>\"INBOX\", content_type=>\"text/plain\">\n Error: Lookup failed l127mb189101572itg", :level=>:error}
{:timestamp=>"2015-06-23T16:03:06.721000+0800", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::IMAP type=>\"mail\", host=>\"imap.gmail.com\", user=>\"infra.gcp\", folder=>\"INBOX\", content_type=>\"text/plain\">\n Error: Lookup failed vu6mb55309015igb", :level=>:error}
I am not sure what is going on of the Error: Lookup failed, the INBOX have the unread email and no attachment.
Any workaround?
Thanks a lot!
