# Cannot create pipeline, expected one of #

**URL:** https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723
**Category:** Logstash
**Created:** [May 15, 2017, 8:48am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723 "2017-05-15T08:48:41Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)
#### Post date: [May 15, 2017, 8:48am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/1 "2017-05-15T08:48:41Z")

</div>

Dear All,

I am trying to follow instructions from this website: [https://github.com/elastic/examples/tree/master/ElasticStack\_apache](https://github.com/elastic/examples/tree/master/ElasticStack_apache)

However, I have got this error when I run this command: `logstash -f apache_logstash.conf`

 ![](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4dc674d63ac47a5bf90c420c410807248eaddfa1.png)

and this is inside my `apache_logstash.conf`

```
  input {  
  stdin { } 
  user => logstash_internal
  password => changeme
}

filter {
  grok {
    match => {
      "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
    }
  }

  date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
  }

  geoip {
    source => "clientip"
  }

  useragent {
    source => "agent"
    target => "useragent"
  }
  
  user => logstash_internal
  password => changeme
}

output {
  stdout {
    codec => dots {}
  }

  elasticsearch {
    index => "apache_elastic_example"
    template => "./apache_template.json"
    template_name => "apache_elastic_example"
    template_overwrite => true
	user => logstash_internal
    password => changeme
  }
}

```

Any ideas how to solve it?

Thank You.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 15, 2017, 8:52am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/2 "2017-05-15T08:52:20Z")

</div>

> [@avdnowhere](#):
>
> user =\> logstash\_internal  
> password =\> changeme

What is this doing in the input block??

---

<div class="post-metadata">

### Author: ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)
#### Post date: [May 15, 2017, 9:47am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/3 "2017-05-15T09:47:22Z")

</div>

I just follow this document: [https://www.elastic.co/guide/en/x-pack/5.4/logstash.html](https://www.elastic.co/guide/en/x-pack/5.4/logstash.html)

Point number 3.

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [May 15, 2017, 10:03am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/4 "2017-05-15T10:03:35Z")

</div>

The doc you linked to is an example using the elasticsearch input. Your config has these field =\> values but they are not needed for the stdin input and if you do add field =\> value sections they should appear inside the `{ }` braces after the word `stdin`  
e.g.

```auto
input {
  plugin_name {
    field1 => "value"
    field2 => "value"
  }
}

```

---

<div class="post-metadata">

### Author: ![avdnowhere](https://avatars.discourse-cdn.com/v4/letter/a/ecccb3/32.png) [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)
#### Post date: [May 18, 2017, 2:21am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/5 "2017-05-18T02:21:15Z")

</div>

Hi,

I have remove user and password fields.  
However, I have got different error:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18de61fddc859ce0cde43cfeee6233c8a49289d9.png)

Any solutions?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2017, 2:21am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723/6 "2017-06-15T02:21:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.