Logstash fails to startup after update after update to 6.8.16

Elastic Stack Logstash
1

I am running elk on debian.
Today there was an update installed, which bumped the logstash version to 6.8.16 from 6.8.15

After this logstash fails to start.
I see the following in the logs:

[    2021-05-27T12:06:38,921][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.8.16"}
    [2021-05-27T12:06:40,692][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/filters/whois>, :path=>"logstash/filters/whois", :type=>"filter", :name=>"whois"}
    [2021-05-27T12:06:40,695][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'whois'. Are you sure this is correct? Trying to load the whois filter plugin resulted in this error: no such file to load -- logstash/filters/whois", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", "org/logstash/plugins/PluginFactoryExt.java:200:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:184:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):324:in `initialize'", "org/jruby/RubyKernel.java:1061:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}
    [2021-05-27T12:06:40,726][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
    [2021-05-27T12:06:45,733][INFO ][logstash.runner          ] Logstash shut down.

Does anyone have ideas on what I could do

2

Does anyone know, if the whois plugin was part of the default bundled plugins?

3

The whois filter is not part of the bundled plugins, it is a third party plugin, you will need to install it again every time you upgrade.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.