Logstash cannot find filter Alter

[motts]

Hello,

I am using Logstash 6.4 and I am trying to install the Alter plugin.

I navigated to "/usr/share/logstash/bin" and then ran
./logstash-plugin install logstash-filter-alter

Everything seemed to go OK. It found the filter and downloaded it. I tried to restart logstash and got this error...

Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (Errno::EACCES) /usr/share/logstash/vendor/bundle/jruby/2.3.0/specifications/logstash-filter-alter-3.0.3.gemspec

So that was an easy fix. I changed the permissions and owner to match everything else in that directory. When I tried to restart logstash again, I get this error now...

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'alter'. Are you sure this is correct? Trying to load the alter filter plugin resulted in this error: no such file to load -- logstash/filters/alter", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", "org/logstash/plugins/PluginFactoryExt.java:210:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:166:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):350:in `'", "org/jruby/RubyKernel.java:994:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in `block in converge_state'"]}

Is there something else I am missing here?

[warkolm (Mark Walkom)]

What does bin/logstash-plugin list --verbose show?

[motts]

It lists the alter filter

[root@localhost bin]# ./logstash-plugin list --verbose
logstash-codec-cef (5.0.6)
logstash-codec-collectd (3.0.8)
logstash-codec-dots (3.0.6)
logstash-codec-edn (3.0.6)
logstash-codec-edn_lines (3.0.6)
logstash-codec-es_bulk (3.0.6)
logstash-codec-fluent (3.2.0)
logstash-codec-graphite (3.0.5)
logstash-codec-json (3.0.5)
logstash-codec-json_lines (3.0.6)
logstash-codec-line (3.0.8)
logstash-codec-msgpack (3.0.7)
logstash-codec-multiline (3.0.10)
logstash-codec-netflow (3.14.1)
logstash-codec-plain (3.0.6)
logstash-codec-rubydebug (3.0.6)
logstash-filter-aggregate (2.8.0)
logstash-filter-alter (3.0.3)
logstash-filter-anonymize (3.0.6)
logstash-filter-cidr (3.1.2)

[motts]

I found the issue. There is another location where the alter plugin is.

/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-alter-3.0.3

while the error was stating this below directory

/usr/share/logstash/vendor/bundle/jruby/2.3.0/specifications/logstash-filter-alter-3.0.3.gemspec

I fixed permissions on both of these and it's now working fine. I imagine this is the other case with several others who are having this problem. I performed a "locate logstash-filter-alter" and checked all the things returned by that command. The two above entries had permissions that were different from the other filters in the same directories. Something should be mentioned in the Documentation regarding these issues. I've had this issue since 5.x was released and the version I am using in the lab is 6.x, so I've had to stay on 2.4 to utilize these features.

I've had at least one post about this issue when it came out and I had no one respond. Just before I posted this, I did a search for topics like this and I have found several posts with no answers.