Logstash Alter filter not found

Elastic Stack Logstash
1

Hello,

I am on CentOS 6.9 and running LS 6.x. I have the Alter filter plugin installed, but when running LS, there is an error and LS will not start:

[2018-03-22T18:41:50,722][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'alter'. Are you sure this is correct? Trying to load the alter filter plugin resulted in this error: no such file to load -- logstash/filters/alter", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:192:in `lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:140:in `lookup'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:81:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:112:in `plugin'", "(eval):227:in `'", "org/jruby/RubyKernel.java:994:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:84:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:458:in `block in trap_sighup'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/trap.rb:46:in `simulate_signal'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/trap.rb:26:in `block in trap'"]}

but the filer is installed. I can even remove it successfully:

[root@elk-logstash-lab02 logstash]# ./bin/logstash-plugin remove logstash-filter-alter
Successfully removed logstash-filter-alter

I tried to reinstall it, but I keep getting the same error.

Thanks for your time.

2

Here is the filter also

/opt/logstash/vendor/bundle/jruby/1.9/cache/logstash-filter-alter-3.0.3.gem
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/CHANGELOG.md
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/CONTRIBUTORS
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/Gemfile
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/LICENSE
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/NOTICE.TXT
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/README.md
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/docs
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/lib
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/logstash-filter-alter.gemspec
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/spec
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/docs/index.asciidoc
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/lib/logstash
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/lib/logstash/filters
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/lib/logstash/filters/alter.rb
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/spec/filters
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/spec/spec_helper.rb
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-alter-3.0.3/spec/filters/alter_spec.rb
/opt/logstash/vendor/bundle/jruby/1.9/specifications/logstash-filter-alter-3.0.3.gemspec
/root/.gem/specs/api.rubygems.org%443/quick/Marshal.4.8/logstash-filter-alter-3.0.3.gemspec
/usr/share/logstash/vendor/bundle/jruby/2.3.0/cache/logstash-filter-alter-3.0.3.gem
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/CHANGELOG.md
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/CONTRIBUTORS
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/Gemfile
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/LICENSE
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/NOTICE.TXT
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/README.md
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/docs
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/lib
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/logstash-filter-alter.gemspec
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/spec
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/docs/index.asciidoc
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/lib/logstash
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/lib/logstash/filters
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/lib/logstash/filters/alter.rb
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/spec/filters
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/spec/spec_helper.rb
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3/spec/filters/alter_spec.rb
/usr/share/logstash/vendor/bundle/jruby/2.3.0/specifications/logstash-filter-alter-3.0.3.gemspec

and here

[root@elk-logstash-lab02 logstash]# ./bin/logstash-plugin list --group filter
logstash-filter-aggregate
logstash-filter-alter
logstash-filter-anonymize
logstash-filter-cidr
3

Has anyone looked into this?

4

Update: any installation of of filters causes logstash to not function. Maybe I am doing something wrong, but here is what I do:

cd /usr/share/logstash

./bin/logstash-plugin install logstash-filter-cipher

To my knowledge, this is the correct way to install filters, but no installation of filters works. Pleas advise.

Thanks

5

Does anyone need any more information? This post has been up about a month now. I cannot roll out 6.2 into production with this hangup here.

6

This thread has been open almost a month now. Has anyone looked into this?

7

Anyone have any suggestions?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.