🚨 Logstash Error: 'Couldn't find any filter plugin named' — Cause, Fix, and Troubleshooting Guide

Overview

At compile time Logstash resolves every plugin your pipeline names against the plugins actually installed in the instance. When the config references a plugin that is not installed — or the name is misspelled, or the plugin was removed in your Logstash version — the registry cannot load it and the agent aborts the pipeline with a ConfigurationError:

[ERROR][logstash.plugins.registry][main] Unable to load plugin. {:type=>"filter", :name=>"geoip2"}
[ERROR][logstash.agent ][main] Failed to execute action {:action_type=>LogStash::ConfigurationError, :message=>"Couldn't find any filter plugin named 'geoip2'. Are you sure this is correct? Trying to load the geoip2 filter plugin resulted in this error: no such file to load -- logstash/filters/geoip2"}

The example names a filter, but the same failure applies to input, output, and codec plugins alike — the registry treats them all the same way. In plain terms: you asked for geoip2 and no plugin by that name exists in this instance. The real plugin is geoip (installed as logstash-filter-geoip); geoip2 is a common misremembering.

Symptoms

• Couldn't find any filter plugin named '<name>' with no such file to load -- logstash/filters/<name> in logstash-plain.log.
• Unable to load plugin. {:type=>"filter", :name=>"..."} from logstash.plugins.registry.
• The pipeline never starts; the agent logs Failed to execute action and shuts that pipeline down.
• bin/logstash -t (config test) fails with the same message, because plugin resolution happens when the config is compiled, not at runtime.
• It appears right after adding a new filter to the config, copying a snippet from a blog, or upgrading Logstash to a version where a bundled plugin was removed.

Common Root Causes

• Plugin not installed — the config uses a plugin that was never installed in this instance (common with non-default plugins).
• Misspelled or wrong name — geoip2 instead of geoip, or a plural/typo that does not match any installed plugin.
• Removed in this version — a plugin bundled in an older Logstash was dropped, so an upgraded instance no longer has it.
• Installed in a different instance — the plugin was installed under a different Logstash home than the one the service runs.
• Air-gapped host with no registry access — bin/logstash-plugin install cannot reach RubyGems, so the plugin was never installed offline.

How to diagnose

First list what is actually installed and grep for the family you expect. If nothing comes back, the plugin is simply not there:

# Is any geoip plugin installed?
/usr/share/logstash/bin/logstash-plugin list | grep -i geoip

# Full list to eyeball exact names
/usr/share/logstash/bin/logstash-plugin list

Run a config test to surface the exact bad name without starting ingest. -t reports the same error because resolution is a compile-time step:

sudo -u logstash /usr/share/logstash/bin/logstash \
  -f /etc/logstash/conf.d/geoip.conf \
  -t --path.settings /etc/logstash

Then find where the bad name is in the config. Logstash .conf files use a Ruby-like DSL, so the filter is shown as ruby:

filter {
  geoip2 {                       # wrong: no such plugin
    source => "client_ip"
    target => "geo"
  }
}

The correct plugin name is geoip, not geoip2.

Fixes

If the name is wrong, correct it to the real plugin name and re-test:

filter {
  geoip {                        # correct plugin name
    source => "client_ip"
    target => "geo"
  }
}

If the plugin is genuinely missing, install it by its full logstash-<type>-<name> gem name, then restart:

# Install the correct plugin, then restart
sudo -u logstash /usr/share/logstash/bin/logstash-plugin install logstash-filter-geoip
sudo systemctl restart logstash

For an air-gapped host that cannot reach RubyGems, build an offline pack on a connected machine and install it from the file on the target:

# On a connected host: bundle the plugin(s)
/usr/share/logstash/bin/logstash-plugin prepare-offline-pack logstash-filter-geoip

# On the air-gapped host: install from the pack
sudo -u logstash /usr/share/logstash/bin/logstash-plugin install \
  file:///opt/packs/logstash-offline-plugins.zip
sudo systemctl restart logstash

After installing or renaming, re-run the -t config test — it should now report the configuration OK.

What to watch out for

• Plugin resolution is a compile-time step, so -t catches this before you ever start ingest — always run it after editing a config.
• Install plugins as the logstash service user (or with the same Logstash home) so they land in the instance the service actually runs.
• The gem name and the config name differ: the config uses geoip, the gem is logstash-filter-geoip. Install by gem name, reference by config name.
• After an upgrade, re-check that every plugin your config uses still exists — bundled plugins are occasionally dropped between major versions.
• On air-gapped hosts, install against a file:// pack is the supported path; do not expect the plugin manager to reach the internet.

Related

• Fix Logstash pipeline create action failures
• Resolve Logstash ‘No configuration found’ errors
• Fix the Logstash translate dictionary not found error