# Ingest-user-agent **URL:** \ **Category:** Elasticsearch\ **Created:** [July 5, 2018, 8:13am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658 "2018-07-05T08:13:08Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 8:13am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/1 "2018-07-05T08:13:09Z")
Hi, I have the elk pack version 6.3.0. One node, on windows. I'm trying to use file beat with the iis module. For that I needed to install the ingest-user-agent and the ingest-geoip plugins. I run the install of the plugins, and when I run "elasticsearch-plugin list", they are both listed. But when I run the elasticsearch api "\_nodes/plugins" i get "plugins": [] Also, when I run "GET \_nodes/ingest", the user agent and geoip are not listed. I should mention that my server is dissconected from the internet. I Installed after downloading the plugin. Do I need to install anything else? Naphtali ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 5, 2018, 8:40am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/2 "2018-07-05T08:40:49Z")
May be you did not restart your nodes? ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 8:43am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/3 "2018-07-05T08:43:57Z")
I restarted the service after installing and it didn't help ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 5, 2018, 8:56am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/4 "2018-07-05T08:56:31Z")
Can you share elasticsearch logs? ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 9:32am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/5 "2018-07-05T09:32:43Z")
> [@dadoonet](#): > > logs The log is quite big. Any thing in specific? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 5, 2018, 10:09am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/6 "2018-07-05T10:09:34Z")
It shouldn't be that big. Share everything that happened at the restart time please. If too big, share on [gist.github.com](http://gist.github.com). ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 10:40am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/7 "2018-07-05T10:40:00Z")
[2018-07-05T13:39:04,906][INFO][o.e.n.Node] [MyNode] initializing ... [2018-07-05T13:39:04,953][INFO][o.e.e.NodeEnvironment] [MyNode] using [1] data paths, mounts [[Data (D:)]], net usable\_space [35.2gb], net total\_space [64.8gb], types [NTFS] [2018-07-05T13:39:04,953][INFO][o.e.e.NodeEnvironment] [MyNode] heap size [2.7gb], compressed ordinary object pointers [true] [2018-07-05T13:39:09,156][INFO][o.e.n.Node] [MyNode] node name [MyNode], node ID [gHrJD8P0QUuUaV7NyuxyBw] [2018-07-05T13:39:09,156][INFO][o.e.n.Node] [MyNode] version[6.3.0], pid[6688], build[default/zip/424e937/2018-06-11T23:38:03.357887Z], OS[Windows Server 2016/10.0/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0\_151/25.151-b12] [2018-07-05T13:39:09,156][INFO][o.e.n.Node] [MyNode] JVM arguments [-XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=C:\Users\046111~1\AppData\Local\Temp\elasticsearch, -XX:+HeapDumpOnOutOfMemoryError, -Xmx2816m, -Xms2816m, -Delasticsearch, -Des.path.home=D:\kits\ELK\elasticsearch-6.3.0, -Des.path.conf=D:\ELK\config, -Des.distribution.flavor=default, -Des.distribution.type=zip, exit, -Xms2816m, -Xmx2816m, -Xss1024k] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [aggs-matrix-stats] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [analysis-common] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [ingest-common] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [lang-expression] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [lang-mustache] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [lang-painless] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [mapper-extras] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [parent-join] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [percolator] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [rank-eval] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [reindex] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [repository-url] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [transport-netty4] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [tribe] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-core] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-deprecation] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-graph] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-logstash] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-ml] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-monitoring] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-rollup] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-security] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-sql] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-upgrade] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] loaded module [x-pack-watcher] [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] no plugins loaded [2018-07-05T13:39:14,969][INFO][o.e.x.m.j.p.l.CppLogMessageHandler] [controller/2012] [Main.cc@109] controller (64 bit): Version 6.3.0 (Build 0f0a34c67965d7) Copyright (c) 2018 Elasticsearch BV [2018-07-05T13:39:15,188][DEBUG][o.e.a.ActionModule] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security [2018-07-05T13:39:16,297][INFO][o.e.d.DiscoveryModule] [MyNode] using discovery type [zen] [2018-07-05T13:39:17,000][INFO][o.e.n.Node] [MyNode] initialized [2018-07-05T13:39:17,000][INFO][o.e.n.Node] [MyNode] starting ... [2018-07-05T13:39:17,172][INFO][o.e.t.TransportService] [MyNode] publish\_address {1.1.1.1:9300}, bound\_addresses {[fe80::a174:26c2:27db:59d1]:9300}, {1.1.1.1:9300} [2018-07-05T13:39:17,469][INFO][o.e.b.BootstrapChecks] [MyNode] bound or publishing to a non-loopback address, enforcing bootstrap checks [2018-07-05T13:39:20,516][INFO][o.e.c.s.MasterService] [MyNode] zen-disco-elected-as-master ([0] nodes joined)[,], reason: new\_master {MyNode}{gHrJD8P0QUuUaV7NyuxyBw}{UFtTGwU\_TPG439vIB68U8A}{MyNode}{1.1.1.1:9300}{ml.machine\_memory=17179262976, xpack.installed=true, ml.max\_open\_jobs=20, ml.enabled=true} [2018-07-05T13:39:20,516][INFO][o.e.c.s.ClusterApplierService] [MyNode] new\_master {MyNode}{gHrJD8P0QUuUaV7NyuxyBw}{UFtTGwU\_TPG439vIB68U8A}{MyNode}{1.1.1.1:9300}{ml.machine\_memory=17179262976, xpack.installed=true, ml.max\_open\_jobs=20, ml.enabled=true}, reason: apply cluster state (from master [master {MyNode}{gHrJD8P0QUuUaV7NyuxyBw}{UFtTGwU\_TPG439vIB68U8A}{MyNode}{1.1.1.1:9300}{ml.machine\_memory=17179262976, xpack.installed=true, ml.max\_open\_jobs=20, ml.enabled=true} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)[,]]]) [2018-07-05T13:39:20,547][INFO][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [MyNode] publish\_address {1.1.1.1:9200}, bound\_addresses {[fe80::a174:26c2:27db:59d1]:9200}, {1.1.1.1:9200} [2018-07-05T13:39:20,547][INFO][o.e.n.Node] [MyNode] started ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 10:43am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/8 "2018-07-05T10:43:50Z")
2018-07-05T13:39:25,079][WARN][o.e.x.s.a.s.m.NativeRoleMappingStore] [MyNode] Failed to clear cache for realms [[]] [2018-07-05T13:39:25,126][INFO][o.e.l.LicenseService] [MyNode] license [88457102-585d-468a-b7f4-aae0ee33d124] mode [basic] - valid [2018-07-05T13:39:25,141][INFO][o.e.g.GatewayService] [MyNode] recovered [185] indices into cluster\_state [2018-07-05T13:39:21,969][INFO][o.e.c.s.ClusterSettings] [MyNode] updating [xpack.monitoring.collection.enabled] from [false] to [true] [2018-07-05T13:39:35,907][DEBUG][o.e.a.s.TransportSearchAction] [MyNode] All shards failed for phase: [query] [2018-07-05T13:39:35,907][WARN][r.suppressed] path: /.kibana/\_search, params: {ignore\_unavailable=true, index=.kibana, filter\_path=aggregations.types.buckets} org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseFailure(AbstractSearchAsyncAction.java:288) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:128) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseDone(AbstractSearchAsyncAction.java:249) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.action.search.InitialSearchPhase.onShardFailure(InitialSearchPhase.java:101) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.action.search.InitialSearchPhase.lambda$performPhaseOnShard$1(InitialSearchPhase.java:210) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.action.search.InitialSearchPhase$1.doRun(InitialSearchPhase.java:189) [elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:724) [elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) [elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.3.0.jar:6.3.0] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0\_151] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0\_151] at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 5, 2018, 12:29pm UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/9 "2018-07-05T12:29:44Z")
Please format your code, logs or configuration files using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable. Or use markdown style like: ```` ``` CODE ``` ```` This is the icon to use if you are not using markdown format: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e6e239431ec2d71cbf1beef741f2e93e7cc762c.jpg) There's a live preview panel for exactly this reasons. Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text. Anyway, we can see that plugins are not loaded here. Which means not installed or not installed in the expected dir. Could you check what you have in plugins dir? ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 12:41pm UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/10 "2018-07-05T12:41:38Z")
This is what I have in the plugin dir ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/690d87d166dd3fee212925b98727872d8c989f6f.png) And as I mentioned earlier, running, elasticsearch-plugin list, returns the plugins. ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7f1e975535346cb8a4b74e380eb80b1ce8c42cb.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 5, 2018, 12:43pm UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/11 "2018-07-05T12:43:57Z")
Have you restarted the node following the installation? ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 5, 2018, 12:58pm UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/12 "2018-07-05T12:58:48Z")
Yes, I restarted the elasticsearch server after installing the plugins ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 5, 2018, 7:38pm UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/13 "2018-07-05T19:38:10Z")
```auto [2018-07-05T13:39:11,219][INFO][o.e.p.PluginsService] [MyNode] no plugins loaded ``` None of the plugins is loaded. Wondering if you a right access issue on this dir. Or if the plugins dir is expected to be actually somewhere else... ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 8, 2018, 8:39am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/14 "2018-07-08T08:39:33Z")
Hi, Thanks for the reply. I am an admin on the server, so I have right access to the dir, and the plugins are installed to the es-home dir. In addition, running elasticsearch-plugin list does return them, so elasticsearch does recognize them. What could prevent the plugins from loading? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 8, 2018, 9:51am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/15 "2018-07-08T09:51:33Z")
I'm sure elasticsearch is looking inside another dir. I remember some past issues where people were setting path.plugins but this property was not read by the plugin manager. So plugin manager thought it installed the plugin but elasticsearch did not see them. I'm almost sure that's the case here. May be change the plugin manager class to debug or check elasticsearch settings. ÉDIT: just realized you are using 6.3.0. So it should work. Debug mode would help then. ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 8, 2018, 10:17am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/16 "2018-07-08T10:17:25Z")
> [@dadoonet](#): > > plugin manager How do I start debug mode? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 8, 2018, 11:01am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/17 "2018-07-08T11:01:02Z")
[https://www.elastic.co/guide/en/elasticsearch/plugins/current/\_other\_command\_line\_parameters.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/_other_command_line_parameters.html) ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/18 "2018-07-08T11:21:37Z")
It looks like it ran without problems ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/822e560eeea45f5a60d81746711d546225b1a82d.png) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 8, 2018, 11:34am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/19 "2018-07-08T11:34:05Z")
Please don't post images of text as they are hardly readable and not searchable. Instead paste the text and format it with `` icon. Check the preview window. Please share all the output ---
**Author:** ![naphtali](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Post date:** [July 8, 2018, 11:35am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658/20 "2018-07-08T11:35:28Z")
``` -> Downloading file:////D:/kits/ELK/ingest-geoip-6.3.0.zip Retrieving zip from file:////D:/kits/ELK/ingest-geoip-6.3.0.zip [=================================================] 100% - Plugin information: Name: ingest-geoip Description: Ingest processor that uses looksup geo data based on ip adresses using the Maxmind geo database Version: 6.3.0 Elasticsearch Version: 6.3.0 Java Version: 1.8 Native Controller: false Extended Plugins: [] * Classname: org.elasticsearch.ingest.geoip.IngestGeoIpPlugin @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin requires additional permissions @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ * java.lang.RuntimePermission accessDeclaredMembers * java.lang.reflect.ReflectPermission suppressAccessChecks See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html for descriptions of what these permissions allow and the associated risks. Continue with installation? [y/N]y -> Installed ingest-geoip ``` [Next page](https://discuss.elastic.co/t/ingest-user-agent/138658.md?page=2)