Can't load installed filter plugin

Elastic Stack Logstash
1

Hi all, I found logstash-filter-jwt-decode plugin to decode jwt tokens, but I am not able to load it despite successfull installation.

Below is what i've done.

bash-4.2$ logstash-plugin install logstash-filter-jwt-decode
...
Validating logstash-filter-jwt-decode
Installing logstash-filter-jwt-decode
Installation successful

bash-4.2$ logstash-plugin list | grep jwt
logstash-filter-jwt-decode

bash-4.2$ grep jwt /usr/share/logstash/Gemfile
gem "logstash-filter-jwt-decode"

bash-4.2$ grep config_name /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-jwt-decode-0.2.0/
logstash-filter-jwt-decode-0.2.0/lib/logstash/filters/jwt-decode.rb:21:  config_name "jwt-decode"

bash-4.2$ cat /usr/share/logstash/pipeline/logstash.conf
input {
  beats {
    port => 5044
  }
}

 filter {
  jwt-decode {
    "match" => "http.request.headers.x-token"
    "signature_alg" => "HS512"
    "extract_fields" => {"jwt.login" => "http.request.jwt.login"}
  }
}

output {
  stdout { codec => rubydebug { metadata => true } }
}


bash-4.2$ logstash -t
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.8.0.jar) to field java.io.FileDescriptor.fd
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2020-01-16T11:24:04,690][INFO ][org.reflections.Reflections] Reflections took 56 ms to scan 1 urls, producing 20 keys and 40 values 
[2020-01-16T11:24:05,538][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- jwt>, :path=>"logstash/filters/jwt-decode", :type=>"filter", :name=>"jwt-decode"}
[2020-01-16T11:24:05,555][FATAL][logstash.runner          ] The given configuration is invalid. Reason: Unable to configure plugins: (PluginLoadingError) Couldn't find any filter plugin named 'jwt-decode'. Are you sure this is correct? Trying to load the jwt-decode filter plugin resulted in this error: no such file to load -- jwt
[2020-01-16T11:24:05,576][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Documentation is not very expansive, so I've checked plugin name into ruby file, I tried too with short documetation examples (jwt-decode) with no success...

Any idea what's wrong with this ?

regards
thomas

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.