Hello!
My knowledge of the inner workings of logstash are still limited, and now I've run into a problem I can't seem to solve.
[ERROR][logstash.plugins.registry] Problems loading a plugin with {:type=>"filter", :name=>"geoip", :path=>"logstash/filters/geoip", :error_message=>"
you might need to reinstall the gem which depends on the missing jar or in case there is Jars.lock then resolve the jars with lock_jars command
no such file to load -- com/maxmind/geoip2/geoip2/2.9.0/geoip2-2.9.0 (LoadError)",
:error_class=>RuntimeError, :error_backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:348:
in do_require'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:255: inrequire_jar'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:0:
in require_jar_with_block'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:254: inrequire_jar'", "/usr/share/logstash/lib/bootstrap/patches/jar_dependencies.rb:6:in require_jar'", "/usr/share/logstash/vendor/local_gems/feb3a0d2/logstash-filter-geoip-4.2.1-java/lib/logstash-filter-geoip_jars.rb:4: in(root)'", "org/jruby/RubyKernel.java:1040:in require'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/polyglot-0.3.5/lib/polyglot.rb:65: inrequire'", "/usr/share/logstash/vendor/local_gems/feb3a0d2/logstash-filter-geoip-4.2.1-java/lib/logstash/filters/geoip.rb:1:
in (root)'", "org/jruby/RubyKernel.java:1040:inrequire'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/polyglot-0.3.5/lib/polyglot.rb:65:
in require'", "/usr/share/logstash/vendor/local_gems/feb3a0d2/logstash-filter-geoip-4.2.1-java/lib/logstash/filters/geoip.rb:5: in(root)'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:138:in lookup'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:180: inlookup_pipeline_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:140:
in lookup'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:100:inplugin'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:1:
in (root)'", "org/jruby/RubyKernel.java:1079:ineval'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/registry.rb:156:
in legacy_lookup'", "(eval):5847:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:72:
in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:156:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:286:
in create_pipeline'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:95:inregister_pipeline'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:314:
in execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in (root)'"]} {:reason=>"Couldn't find any filter plugin named 'geoip'. Are you sure this is correct? Trying to load the geoip filter plugin resulted in this error: Problems loading the requested plugin named geoip of type filter. Error: RuntimeError you might need to reinstall the gem which depends on the missing jar or in case there is Jars.lock then resolve the jars withlock_jars` command
no such file to load -- com/maxmind/geoip2/geoip2/2.9.0/geoip2-2.9.0 (LoadError)"}
My filter config:
filter {
if [program] == "haproxy" {
geoip {
database => "/usr/share/GeoIP/GeoIP.dat"
source => "client_ip"
}
}
}
root@logstash1:~# ls -l /usr/share/GeoIP/GeoIP.dat
-rw-r--r-- 1 root root 1746528 Jul 13 10:00 /usr/share/GeoIP/GeoIP.dat
root@logstash1:~# /usr/share/logstash/bin/logstash-plugin list |grep geoip
logstash-filter-geoip
root@logstash1:~# /usr/share/logstash/bin/logstash -t -f /etc/logstash/conf.d/ --path.settings /etc/logstash
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK
root@logstash1:~#
Any help/pointers would be greatly appreciated.