Hello,
I am using Logstash 6.2 currently and I am trying to get any downloadable filters to work, but when starting Logstash, I get an error stating that all of the downloaded filters cannot be found. Here is an example for the Alter plugin:
[ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'alter'. Are you sure this is correct? Trying to load the alter filter plugin resulted in this error: no such file to load -- logstash/filters/alter", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:192:in lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:140:inlookup'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:81:in plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:112:inplugin'", "(eval):227:in <eval>'", "org/jruby/RubyKernel.java:994:ineval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:84:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:inblock in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:inblock in converge_state'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:inconverge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:458:inblock in trap_sighup'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/trap.rb:46:insimulate_signal'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/trap.rb:26:in block in trap'"]}`
I did find another error in /var/log/logstash-stdout.log stating the gem for each of the filters didn't have sufficient access:
[ERROR] 2018-04-10 11:09:27.790 [main] Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (Errno::EACCES) /usr/share/logstash/vendor/bundle/jruby/2.3.0/specifications/logstash-filter-cipher-3.0.1.gemspec
So I changed their permission to sufficient levels to no longer cause this error. Is there anything else I need to do for these? I cannot seem to find any other process other than to use
./bin/logstash-plugin install logstash-filter-(name)
Here is an output of all the installed filters. As you can see, Alter and Cipher are both showing as installed.
./bin/logstash-plugin list --group filter
logstash-filter-aggregate
logstash-filter-alter
logstash-filter-anonymize
logstash-filter-cidr
logstash-filter-cipher
...
Thanks for your time.