# Can't run logstash. pathname contains null byte **URL:** \ **Category:** Logstash\ **Created:** [June 14, 2020, 1:50am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008 "2020-06-14T01:50:35Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 1:50am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/1 "2020-06-14T01:50:35Z")
I'm trying to run logstash for elasticsearch but getting this error. I don't know what is the reason. Please help me. ```auto [ERROR] 2020-06-14 01:17:31.633 [[main]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=>["org/jruby/ext/pathname/RubyPathname.java:197:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:274:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:273:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:327:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:287:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#"} [ERROR] 2020-06-14 01:17:31.667 [Converge PipelineAction::Create
] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create
, action_result: false", :backtrace=>nil} ``` here is my configuration file: ```auto input { file { path => "/home/rsa-key-20200528/aslogger.log" type => "apache" start_position => "beginning" } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["exaple_host:9200"] index => "aslogger" } } ``` here is sample of my log: ```auto 109.169.248.247 - - [12/Dec/2015:18:25:11 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" 46.72.177.4 - - [12/Dec/2015:18:31:08 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" 46.72.177.4 - - [12/Dec/2015:18:31:08 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" 83.167.113.100 - - [12/Dec/2015:18:31:25 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" 83.167.113.100 - - [12/Dec/2015:18:31:25 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" 95.29.198.15 - - [12/Dec/2015:18:32:10 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-" ``` ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 14, 2020, 3:20am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/2 "2020-06-14T03:20:24Z")
how did you run logstash? systemctl? of cli? ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 3:32am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/3 "2020-06-14T03:32:49Z")
systemctl ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 14, 2020, 3:35am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/4 "2020-06-14T03:35:29Z")
you will need to show your logstash.yml, pipelines.yml. also, in which directory is your config file located? ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 3:47am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/5 "2020-06-14T03:47:55Z")
Sorry for late reply. Here is the my run command: sudo ./logstash -f /usr/share/logstash/bin/logstash.conf ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 3:50am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/6 "2020-06-14T03:50:14Z")
I didn't do anything with pipelines.yml ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 14, 2020, 4:08am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/7 "2020-06-14T04:08:04Z")
i’m confused. you said before you’re running with systemctl, now you run it with cli. > [@Mahathir\_Mohammad](#): > > sudo ./logstash -f /usr/share/logstash/bin/logstash.conf what’s the output of the above command ? ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 4:35am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/8 "2020-06-14T04:35:38Z")
Sorry, first time I did mistake. Second time I just copy-paste from my command line. Help me according to this command: sudo ./logstash -f /usr/share/logstash/bin/logstash.conf What is the wrong? What should I do? ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 4:43am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/9 "2020-06-14T04:43:18Z")
I'm a beginner in elasticsearch. I just know about basic things. Help me ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 14, 2020, 4:53am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/10 "2020-06-14T04:53:12Z")
> [@Mahathir\_Mohammad](#): > > sudo ./logstash -f /usr/share/logstash/bin/logstash.conf run this command and share the errors that you encountered ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 5:01am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/11 "2020-06-14T05:01:32Z")
I did run this command and I shared those two error in my topic. ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 14, 2020, 6:04am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/12 "2020-06-14T06:04:27Z")
> [@Mahathir\_Mohammad](#): > > ```auto > input { > file { > path => "/home/rsa-key-20200528/aslogger.log" > type => "apache" > start_position => "beginning" > } > } > > output { > stdout { > codec => rubydebug > } > elasticsearch { > hosts => ["exaple_host:9200"] > index => "aslogger" > } > } > > ``` and this is the content of /usr/share/logstash/bin/logstash.conf ? that’s strange because logstash is complaining that that file is null-byte . have you tried using other config? it will be good if you can show the whole error message after you run the comand ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 6:23am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/13 "2020-06-14T06:23:26Z")
Yes, I also though it is strange. So that I checked the file size in server. That is 239 bytes. I also download that file and saw everything is ok. Anyway here is the full error. It is too big: ```auto WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2020-06-14 06:22:00.675 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2020-06-14 06:22:00.700 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.7.1"} [INFO] 2020-06-14 06:22:04.341 [Converge PipelineAction::Create
] Reflections - Reflections took 103 ms to scan 1 urls, producing 21 keys and 41 values [INFO] 2020-06-14 06:22:08.165 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://34.82.215.36:9200/]}} [WARN] 2020-06-14 06:22:08.696 [[main]-pipeline-manager] elasticsearch - Restored connection to ES instance {:url=>"http://34.82.215.36:9200/"} [INFO] 2020-06-14 06:22:09.133 [[main]-pipeline-manager] elasticsearch - ES Output version determined {:es_version=>7} [WARN] 2020-06-14 06:22:09.142 [[main]-pipeline-manager] elasticsearch - Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7} [INFO] 2020-06-14 06:22:09.249 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//34.82.215.36:9200"]} [INFO] 2020-06-14 06:22:09.411 [Ruby-0-Thread-6: :1] elasticsearch - Using default mapping template [INFO] 2020-06-14 06:22:09.514 [Ruby-0-Thread-6: :1] elasticsearch - Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} [WARN] 2020-06-14 06:22:09.558 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team. [INFO] 2020-06-14 06:22:09.573 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>125, "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#"} [ERROR] 2020-06-14 06:22:12.266 [[main]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=>["org/jruby/ext/pathname/RubyPathname.java:197:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:274:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:273:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:327:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:287:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#"} [ERROR] 2020-06-14 06:22:12.304 [Converge PipelineAction::Create
] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create
, action_result: false", :backtrace=>nil} [INFO] 2020-06-14 06:22:12.935 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600} [INFO] 2020-06-14 06:22:17.690 [LogStash::Runner] runner - Logstash shutdownn. ``` ---
**Author:** ![Mahathir\_Mohammad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahathir_mohammad/32/70316_2.png) [@Mahathir\_Mohammad](https://discuss.elastic.co/u/Mahathir_Mohammad)\ **Post date:** [June 14, 2020, 7:25am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/14 "2020-06-14T07:25:54Z")
A nice guy from stackoverflow solved my problem. The main problem was my motherfu\*\*\*r FTP clients software. Everytime this software change my path location with some unwanted "@". I upload this: ```auto path => "/home/rsa-key-20200528/aslogger.log" ``` and this software convert into this: ```auto path => "/home/rsa-key-20200528^@^@^@^@^@^@/*.log" ``` it ruined my configuration just putting some "@". Then I check the file according to his answer and edit this line with nano. Now everything is fine. Also I want to say thank you too. Although it is very hard to guise the problem is happening for FTP clients but your try to help me. thanks for that❤ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2020, 7:26am UTC](https://discuss.elastic.co/t/cant-run-logstash-pathname-contains-null-byte/237008/15 "2020-07-12T07:26:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.