Logstash startup issue

Elastic Stack Logstash
1

we are having issue in starting up logstash stating Couldn't find any filter plugin 'grok'..Please find the error logs below.
[2018-04-18T13:06:32,281][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/filters/Grok>, :path=>"logstash/filters/Grok", :type=>"filter", :name=>"Grok"}
[2018-04-18T13:06:32,287][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'Grok'. Are you sure this is correct? Trying to load the Grok filter plugin resulted in this error: no such file to load -- logstash/filters/Grok", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:192:in lookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:140:inlookup'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:81:in plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:112:inplugin'", "(eval):636:in <eval>'", "org/jruby/RubyKernel.java:994:ineval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:84:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:inblock in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:inblock in converge_state'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:inconverge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:inblock in initialize'"]}

Can you please help me in resolving this error

2

Logstash plugin names are case-sensitive. Does your pipeline configuration reference Grok? The correct form is grok.

1 Like
3

how can i check the pipeline configuration ? is it the one available under /etc/logstash/conf.d/logstash.conf file filter section?

or i have to refer to any plugin directory?

4

The pipeline configuration is the file in which you define your pipeline, with inputs, filters, and outputs.

5

ok got it.this is the place /etc/logstash/conf.d/logstash.conf where i have defined inputs, filters and output block.

I will try to check in this file,But incase if i have used only lower case grok pattern here, then what could be the issue ?any idea?

6

Please paste your pipeline configuration if you are able.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.