Could not determine ID for filter/useragent

Elastic Stack Logstash
1

We have upgraded logstash from 7.5.2 to 7.16.2 on three separate instances. The first two upgraded with no issues whatsoever, however the final upgrade encountered this problem and now logstash crashes:

Stack trace:

[2022-01-13T11:54:52,979][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/
pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Could not determine ID for filter/useragent", :backtrac
e=>["org/logstash/plugins/factory/PluginFactoryExt.java:221:in `plugin'", "org/logstash/plugins/factory/PluginFactoryExt.java:203:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:99:in `plugin'", "(eval):166193:in `initialize'", "org/jruby/RubyKernel.java:1048:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:73:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:118:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}

The configuration files are exactly the same on all three instances which makes this extra odd.

Any ideas on what I can try and rule out? According to the docs the id's for filters should be auto generated, but that error seems to suggest they are not.

2

Can you try manually defining an id?

Not sure why it wouldn't work on this instance when it works on others.
But when having multiple logstash filters it's good practice to define your own id's as it makes troubleshooting much easier.

3

If I do that then it complains about a different filter with the same error. It's as though the automatic ID generation isn't working.

Also due to the size of our configuration it isn't realistic to add ID fields everywhere.

4

Are you certain the configurations are identical? It could be an issue like this one, where a trailing newline causes that error.

5

Thank you! That is exactly what the problem was - A newline character in a configuration file.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.