# Logstash cannot find filter Alter
**URL:** https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558
**Category:** Logstash
**Created:** [November 13, 2018, 10:43pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558 "2018-11-13T22:43:37Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@motts](https://discuss.elastic.co/u/motts)
#### Post date: [November 13, 2018, 10:43pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558/1 "2018-11-13T22:43:38Z")
Hello,
I am using Logstash 6.4 and I am trying to install the Alter plugin.
I navigated to "/usr/share/logstash/bin" and then ran
./logstash-plugin install logstash-filter-alter
Everything seemed to go OK. It found the filter and downloaded it. I tried to restart logstash and got this error...
> Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (Errno::EACCES) /usr/share/logstash/vendor/bundle/jruby/2.3.0/specifications/logstash-filter-alter-3.0.3.gemspec
So that was an easy fix. I changed the permissions and owner to match everything else in that directory. When I tried to restart logstash again, I get this error now...
> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::PluginLoadingError", :message=\>"Couldn't find any filter plugin named 'alter'. Are you sure this is correct? Trying to load the alter filter plugin resulted in this error: no such file to load -- logstash/filters/alter", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", "org/logstash/plugins/PluginFactoryExt.java:210:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:166:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):350:in `'", "org/jruby/RubyKernel.java:994:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in `block in converge\_state'"]}
Is there something else I am missing here?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 14, 2018, 1:56am UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558/2 "2018-11-14T01:56:58Z")
What does `bin/logstash-plugin list --verbose` show?
---
### Author:  [@motts](https://discuss.elastic.co/u/motts)
#### Post date: [November 14, 2018, 2:02pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558/3 "2018-11-14T14:02:06Z")
It lists the alter filter
> [root@localhost bin]# ./logstash-plugin list --verbose
> logstash-codec-cef (5.0.6)
> logstash-codec-collectd (3.0.8)
> logstash-codec-dots (3.0.6)
> logstash-codec-edn (3.0.6)
> logstash-codec-edn\_lines (3.0.6)
> logstash-codec-es\_bulk (3.0.6)
> logstash-codec-fluent (3.2.0)
> logstash-codec-graphite (3.0.5)
> logstash-codec-json (3.0.5)
> logstash-codec-json\_lines (3.0.6)
> logstash-codec-line (3.0.8)
> logstash-codec-msgpack (3.0.7)
> logstash-codec-multiline (3.0.10)
> logstash-codec-netflow (3.14.1)
> logstash-codec-plain (3.0.6)
> logstash-codec-rubydebug (3.0.6)
> logstash-filter-aggregate (2.8.0)
> **logstash-filter-alter (3.0.3)**
> logstash-filter-anonymize (3.0.6)
> logstash-filter-cidr (3.1.2)
---
### Author:  [@motts](https://discuss.elastic.co/u/motts)
#### Post date: [November 14, 2018, 7:05pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558/4 "2018-11-14T19:05:07Z")
I found the issue. There is another location where the alter plugin is.
> /usr/share/logstash/vendor/bundle/jruby/2.3.0/ **gems** /logstash-filter-alter-3.0.3
while the error was stating this below directory
> /usr/share/logstash/vendor/bundle/jruby/2.3.0/ **specifications** /logstash-filter-alter-3.0.3.gemspec
I fixed permissions on both of these and it's now working fine. I imagine this is the other case with several others who are having this problem. I performed a "locate logstash-filter-alter" and checked all the things returned by that command. The two above entries had permissions that were different from the other filters in the same directories. Something should be mentioned in the Documentation regarding these issues. I've had this issue since 5.x was released and the version I am using in the lab is 6.x, so I've had to stay on 2.4 to utilize these features.
I've had at least one post about this issue when it came out and I had no one respond. Just before I posted this, I did a search for topics like this and I have found several posts with no answers.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2018, 7:05pm UTC](https://discuss.elastic.co/t/logstash-cannot-find-filter-alter/156558/5 "2018-12-12T19:05:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.