After upgrading to version 9.x + running plugin updates, the filter "logstash-filter-json_encode" becomes absent from the system, and pipelines that use it begin to fail.
Interestingly, when one does a list query for it, it does not show up as available either:
# /usr/share/logstash/bin/logstash-plugin list | grep json
Using bundled JDK: /usr/share/logstash/jdk
logstash-codec-json
logstash-codec-json_lines
logstash-filter-json
Manually installing it succeeds, then it shows up in the listing:
# /usr/share/logstash/bin/logstash-plugin install logstash-filter-json_encode
Using bundled JDK: /usr/share/logstash/jdk
Validating logstash-filter-json_encode
Resolving mixin dependencies
Installing logstash-filter-json_encode
Installation successful
# /usr/share/logstash/bin/logstash-plugin list --verbose | grep json
Using bundled JDK: /usr/share/logstash/jdk
logstash-codec-json (3.1.1)
logstash-codec-json_lines (3.2.2)
logstash-filter-json (3.2.1)
logstash-filter-json_encode (3.0.3)
One would think that if the --installed option was omitted then a list of all available plugins would be printed out, but I could be wrong on that.
# /usr/share/logstash/bin/logstash-plugin list --help
Using bundled JDK: /usr/share/logstash/jdk
Usage:
bin/logstash-plugin list [OPTIONS] [PLUGIN]
Parameters:
[PLUGIN] Part of plugin name to search for, leave empty for all plugins
Options:
--installed List only explicitly installed plugins using bin/logstash-plugin install ... (default: false)
--[no-]expand Expand integration plugins and aliases (default: true)
--verbose Also show plugin version number (default: false)
--group NAME Filter plugins per group: input, output, filter, codec or integration
-h, --help print help
My workaround for now is to have a task to run the installer right after the other plugins are updated.
This is right in line with the Logstash rpm not being available, specifically to satellite content view filters, via the elastic yum repository, because of some issue with the meta-data. Elastic, Kibana, and others all work fine. That is a separate issue, I know, but just another Logstash issue seemingly due to it not getting the same attention as the E & K get, in the ELK stack. 