Logstash fails to startup after update after update to 6.8.16

I am running elk on debian.
Today there was an update installed, which bumped the logstash version to 6.8.16 from 6.8.15

After this logstash fails to start.
I see the following in the logs:

[    2021-05-27T12:06:38,921][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.8.16"}
    [2021-05-27T12:06:40,692][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/filters/whois>, :path=>"logstash/filters/whois", :type=>"filter", :name=>"whois"}
    [2021-05-27T12:06:40,695][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'whois'. Are you sure this is correct? Trying to load the whois filter plugin resulted in this error: no such file to load -- logstash/filters/whois", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", "org/logstash/plugins/PluginFactoryExt.java:200:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:184:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):324:in `initialize'", "org/jruby/RubyKernel.java:1061:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}
    [2021-05-27T12:06:40,726][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
    [2021-05-27T12:06:45,733][INFO ][logstash.runner          ] Logstash shut down.

Does anyone have ideas on what I could do

Does anyone know, if the whois plugin was part of the default bundled plugins?

The whois filter is not part of the bundled plugins, it is a third party plugin, you will need to install it again every time you upgrade.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.