# Error: Cannot create pipeline

**URL:** <https://discuss.elastic.co/t/error-cannot-create-pipeline/105255>\
**Category:** Logstash\
**Created:** [October 25, 2017, 1:45pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255 "2017-10-25T13:45:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaochan](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@kaochan](https://discuss.elastic.co/u/kaochan)\
**Post date:** [October 25, 2017, 1:45pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255/1 "2017-10-25T13:45:53Z")

</div>

Hi,

I'm new in ELK and i'm having a problem with logstash trying to filter my application log.

This is my config file:

input {  
file {  
path =\> "/var/log/application/application.log"  
start\_position =\> "beginning"  
type =\> "logs"  
}  
filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:log\_level} [%{DATA:thread}] %{JAVACLASS:class} %{GREEDYDATA:message}" ]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200\>"  
index =\> "logstash-%{+YYYY.MM.dd}"  
}  
}

And this is the error i get:

[2017-10-25T15:43:23,420][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, =\> at line 8, column 10 (byte 162) after input {\n file {\n path =\> "/var/log/application/application.log"\n start\_position =\> "beginning"\n type =\> "logs"\n }\n filter {\n grok "}

Also tried with codec multiline but got same error:

[2017-10-25T15:19:37,483][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, { at line 7, column 9 (byte 150) after input {\n file {\n path =\> "/var/log/application/application.log"\n start\_position =\> "beginning"\n type =\> "logs"\n }\n codec "}

I thought maybe i had not plugins installed but they are by default:

# /usr/share/logstash/bin/logstash-plugin list

logstash-codec-cef  
logstash-codec-collectd  
logstash-codec-dots  
logstash-codec-edn  
logstash-codec-edn\_lines  
logstash-codec-es\_bulk  
logstash-codec-fluent  
logstash-codec-graphite  
logstash-codec-json  
logstash-codec-json\_lines  
logstash-codec-line  
logstash-codec-msgpack  
logstash-codec-multiline  
logstash-codec-netflow  
logstash-codec-plain  
logstash-codec-rubydebug  
logstash-filter-cidr  
logstash-filter-clone  
logstash-filter-csv  
logstash-filter-date  
logstash-filter-dissect  
logstash-filter-dns  
logstash-filter-drop  
logstash-filter-fingerprint  
logstash-filter-geoip  
logstash-filter-grok  
logstash-filter-json  
logstash-filter-kv  
logstash-filter-metrics  
logstash-filter-mutate  
logstash-filter-ruby  
logstash-filter-sleep  
logstash-filter-split  
logstash-filter-syslog\_pri  
logstash-filter-throttle  
logstash-filter-translate  
logstash-filter-urldecode  
logstash-filter-useragent  
logstash-filter-uuid  
logstash-filter-xml  
logstash-input-beats  
logstash-input-couchdb\_changes  
logstash-input-dead\_letter\_queue  
logstash-input-elasticsearch  
logstash-input-exec  
logstash-input-file  
logstash-input-ganglia  
logstash-input-gelf  
logstash-input-generator  
logstash-input-graphite  
logstash-input-heartbeat  
logstash-input-http  
logstash-input-http\_poller  
logstash-input-imap  
logstash-input-irc  
logstash-input-jdbc  
logstash-input-kafka  
logstash-input-log4j  
logstash-input-lumberjack  
logstash-input-pipe  
logstash-input-rabbitmq  
logstash-input-redis  
logstash-input-s3  
logstash-input-snmptrap  
logstash-input-sqs  
logstash-input-stdin  
logstash-input-syslog  
logstash-input-tcp  
logstash-input-twitter  
logstash-input-udp  
logstash-input-unix  
logstash-input-xmpp  
logstash-output-cloudwatch  
logstash-output-csv  
logstash-output-elasticsearch  
logstash-output-file  
logstash-output-graphite  
logstash-output-http  
logstash-output-irc  
logstash-output-kafka  
logstash-output-nagios  
logstash-output-null  
logstash-output-pagerduty  
logstash-output-pipe  
logstash-output-rabbitmq  
logstash-output-redis  
logstash-output-s3  
logstash-output-sns  
logstash-output-sqs  
logstash-output-statsd  
logstash-output-stdout  
logstash-output-tcp  
logstash-output-udp  
logstash-output-webhdfs  
logstash-output-xmpp  
logstash-patterns-core

Can you help me? Any thoughts?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2017, 2:03pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255/2 "2017-10-25T14:03:07Z")

</div>

You need one additional `}` prior to `filter`.

---

<div class="post-metadata">

**Author:** ![kaochan](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@kaochan](https://discuss.elastic.co/u/kaochan)\
**Post date:** [October 25, 2017, 2:24pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255/3 "2017-10-25T14:24:00Z")

</div>

My god, i was getting crazy, filter goes out of input xD

Thanks a lot!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2017, 2:24pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255/4 "2017-11-22T14:24:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.