# Elastic Cloud Setup : Pipeline Worker Stops in Logstash

**URL:** <https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051>\
**Category:** Logstash\
**Created:** [January 21, 2019, 1:14pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051 "2019-01-21T13:14:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deepankar\_Biswas1](https://avatars.discourse-cdn.com/v4/letter/d/67e7ee/32.png) [@Deepankar\_Biswas1](https://discuss.elastic.co/u/Deepankar_Biswas1)\
**Post date:** [January 21, 2019, 1:14pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/1 "2019-01-21T13:14:17Z")

</div>

I have a setup of ES, Kibana on the cloud and LS and Filebeat (2 nodes). It was all working fine but suddenly i I see today that the pipelines stop in LS with the following error:

[2019-01-21T12:51:07,188][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"Could not set field 'city\_name' on object '49.35.23.207' to value 'Mumbai'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string",

Here is my logstash configuration  
if [type] == "api" {  
grok {  
match =\> { "message" =\> "%{IP:s2sip} %{USER:user} %{USER:auth} [%{HTTPDATE:timestamp}] %{GREEDYDATA:botmanpath}" }  
}  
grok {  
match =\> { "botmanpath" =\> "%{URIPARAM:botman\_query}" }  
}

kv {  
source =\> "botmanpath"  
field\_split =\> "&?"  
prefix =\> "bq\_"  
}

geoip {  
source =\> "bq\_ip"  
add\_field =\> ["[bq\_ip][coordinates]", "%{[bq\_ip][longitude]}" ]  
add\_field =\> ["[bq\_ip][coordinates]", "%{[bq\_ip][latitude]}" ]  
}  
mutate {  
convert =\> ["[bq\_ip][coordinates]", "float"]  
}

useragent {  
source =\> "bq\_s6"  
}  
}  
}

output {  
if [type] == "tag" {  
elasticsearch {  
hosts =\> ["--"]  
user =\> ["--"]  
password =\>["--"]  
index =\> ["%{[parsed][bizid]}-%{+YYYY.MM.dd}" ]  
}  
}  
if [type] == "api" {  
elasticsearch {  
hosts =\> ["--"]  
user =\> ["--"]  
password =\>["--"]  
index =\> ["%{[parsed][bizid]}-%{+YYYY.MM.dd}" ]  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 21, 2019, 1:35pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/2 "2019-01-21T13:35:13Z")

</div>

> [@Deepankar\_Biswas1](#):
>
> add\_field =\> ["[bq\_ip][coordinates]", "%{[bq\_ip][longitude]}" ]  
> add\_field =\> ["[bq\_ip][coordinates]", "%{[bq\_ip][latitude]}" ]

bq\_ip is probably a string, so it does not have latitude/longitude sub-fields, and you cannot add a city\_name to it. Did you mean

```
    add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]

```

---

<div class="post-metadata">

**Author:** ![Deepankar\_Biswas1](https://avatars.discourse-cdn.com/v4/letter/d/67e7ee/32.png) [@Deepankar\_Biswas1](https://discuss.elastic.co/u/Deepankar_Biswas1)\
**Post date:** [January 21, 2019, 1:47pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/3 "2019-01-21T13:47:27Z")

</div>

Yes. that's right

---

<div class="post-metadata">

**Author:** ![Deepankar\_Biswas1](https://avatars.discourse-cdn.com/v4/letter/d/67e7ee/32.png) [@Deepankar\_Biswas1](https://discuss.elastic.co/u/Deepankar_Biswas1)\
**Post date:** [January 21, 2019, 1:49pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/4 "2019-01-21T13:49:18Z")

</div>

In fact, I added those after the error. If I remove the add\_fields, the error persists

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 21, 2019, 2:11pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/5 "2019-01-21T14:11:56Z")

</div>

Can you show us your configuration?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 2:15pm UTC](https://discuss.elastic.co/t/elastic-cloud-setup-pipeline-worker-stops-in-logstash/165051/6 "2019-02-18T14:15:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.