Recently while configuring a logstash pipeline,I’ve been through an error that was a bit tricky to find since it was referring to a missing plugin named ‘else’.

Searching the issue a bit didn’t  show much help, So I hope this saves couple hours/minutes trying to find out the root cause.
Here’s an interesting part from the Exception Message

The given configuration is invalid. Reason: Couldn’t find any filter plugin named ‘else’…

The full error message is below,

~/logstash$ bin/logstash -f config/pipelines/test.conf -t
Sending Logstash logs to /home/user/logstash/logs which is now configured via log4j2.properties
[2018-10-01T21:31:21,666][WARN ][logstash.config.source.multilocal] Ignoring the ‘pipelines.yml’ file because modules or command line options are specified
[2018-10-01T21:31:25,060][ERROR][logstash.plugins.registry] Tried to load a plugin’s code, but failed. {:exception=>#, :path=>”logstash/filters/else”, :type=>”filter”, :name=>”else”}
[2018-10-01T21:31:25,082][FATAL][logstash.runner ] The given configuration is invalid. Reason: Couldn’t find any filter plugin named ‘else’. Are you sure this is correct? Trying to load the else filter plugin resulted in this error: no such file to load — logstash/filters/else
[2018-10-01T21:31:25,099][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

This error was caused by the below sample configurations in the filter phase

filter {
    if [path] =~ “ip” {
        grok {“add_tag” => [“grok_parsed_ip”]}
    } else { add_tag => [“unprocessed”]}
}

So, the root cause of the issue was due to the structure of the filter phase, and missing the actual plugin “mutate” which should be used for further processing.

This issue was resolved by correcting the configurations and adding a proper plugin under the else statement

filter {
    if [path] =~ “ip” {
        grok {“add_tag” => [“grok_parsed_ip”]}
    } else { mutate {add_tag => [“unprocessed”]}}
}