# Logstash Issue in finding the filter

**URL:** <https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [September 6, 2020, 4:53pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683 "2020-09-06T16:53:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tamilarasanbravo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilarasanbravo/32/62962_2.png) [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\
**Post date:** [September 6, 2020, 4:53pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683/1 "2020-09-06T16:53:07Z")

</div>

Hi Team,

I am trying to get the logstash configured but I am unable to start the logstash with the below error.

The file exists but still the logstash fails to open/read it.

```auto
[2020-09-06T12:50:11,299][INFO][org.reflections.Reflections] Reflections took 38 ms to scan 1 urls, producing 22 keys and 45 values
[2020-09-06T12:50:11,704][ERROR][logstash.filters.ruby] Invalid setting for ruby filter plugin:

  filter {
    ruby {
      # This setting must be a path
      # File does not exist or cannot be opened /root/removeKeys.rb
      path => "/root/removeKeys.rb"
      ...
    }
  }
[2020-09-06T12:50:11,721][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:http-plugin, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:119)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:82)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$ __VARARGS__ (/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
[2020-09-06T12:50:11,737][ERROR][logstash.agent] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<http-plugin>`"}
[2020-09-06T12:50:11,777][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<http-plugin>`>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in `create'", "org/logstash/execution/ConvergeResultExt.java:57:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:370:in `block in converge_state'"]}
[2020-09-06T12:50:11,792][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
^C
[root@githublogmaster conf.d]# ls -al /root/removeKeys.rb
-rwxrwxrwx 1 root root 815 Jun 29 15:42 /root/removeKeys.rb
[root@githublogmaster conf.d]#

```

Regards  
TJ

---

<div class="post-metadata">

**Author:** ![tamilarasanbravo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilarasanbravo/32/62962_2.png) [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\
**Post date:** [September 6, 2020, 5:13pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683/2 "2020-09-06T17:13:36Z")

</div>

Adding more useful logs to the thread

```auto
[2020-09-06T12:50:11,704][ERROR][logstash.filters.ruby] Invalid setting for ruby filter plugin:

  filter {
    ruby {
      # This setting must be a path
      # File does not exist or cannot be opened /root/removeKeys.rb
      path => "/root/removeKeys.rb"
      ...
    }
  }
[2020-09-06T12:50:11,721][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:http-plugin, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:119)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:82)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$ __VARARGS__ (/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
[2020-09-06T12:50:11,737][ERROR][logstash.agent] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<http-plugin>`"}
[2020-09-06T12:50:11,777][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<http-plugin>`>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in `create'", "org/logstash/execution/ConvergeResultExt.java:57:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:370:in `block in converge_state'"]}
[2020-09-06T12:50:11,792][ERROR][org.logstash.Logstash] java.lang.Ill

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 6, 2020, 5:21pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683/3 "2020-09-06T17:21:48Z")

</div>

What does 'ls -ld /root' look like, and what user are you running logstash as?

---

<div class="post-metadata">

**Author:** ![tamilarasanbravo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilarasanbravo/32/62962_2.png) [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\
**Post date:** [September 6, 2020, 6:40pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683/4 "2020-09-06T18:40:38Z")

</div>

It was just holding execution permission. When I gave read & exec permission, it worked.

```auto
[root@githublogmaster conf.d]# ls -ld /root
dr-xr-x---. 16 root root 4096 Sep 6 12:49 /root
[root@githublogmaster conf.d]# chmod 755 /root
[root@githublogmaster conf.d]# ls -ld /root
drwxr-xr-x. 16 root root 4096 Sep 6 12:49 /root
[root@githublogmaster conf.d]#

```

One last doubt, I got the below error while running the logstash. May I know what it means in details.

Note : I run elasicsearch with Docker Swarm(7.9.1) image same as logstash version.

```auto
DEPRECATION WARNING: Connecting to an OSS distribution of Elasticsearch using the default distribution of Logstash will stop working in Logstash 8.0.0

```

Thank you  
TJ

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2020, 6:40pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683/5 "2020-10-04T18:40:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.