# Error creating input: Can only start an input when all related states are finished

**URL:** <https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 18, 2018, 10:25pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249 "2018-11-18T22:25:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hoon\_Cho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoon_cho/32/52426_2.png) [@Hoon\_Cho](https://discuss.elastic.co/u/Hoon_Cho)\
**Post date:** [November 18, 2018, 10:25pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249/1 "2018-11-18T22:25:59Z")

</div>

I run filebeat with system module enabled and filebeat log like this..

> 2018-11-19T07:18:31.662+0900 INFO log/input.go:138 Configured paths: [/var/log/secure\*]  
> 2018-11-19T07:18:31.666+0900 ERROR fileset/factory.go:105 Error creating input: Can only start an input when all related states are finished: {Id:17600537-64768 Finished:false Fileinfo:0xc4203f0b60 Source:/var/log/messages Offset:1950248 Timestamp:2018-11-19 07:18:26.962331439 +0900 KST m=+428.768260414 TTL:-1ns Type:log Meta:map FileStateOS:17600537-64768}  
> 2018-11-19T07:18:31.666+0900 ERROR [reload] cfgfile/list.go:96 Error creating runner from config: Can only start an input when all related states are finished: {Id:17600537-64768 Finished:false Fileinfo:0xc4203f0b60 Source:/var/log/messages Offset:1950248 Timestamp:2018-11-19 07:18:26.962331439 +0900 KST m=+428.768260414 TTL:-1ns Type:log Meta:map FileStateOS:17600537-64768}

elasticsearch cannot parsing system log exactly.  
`[Filebeat System] Syslog dashboard` cannot show system log and auth log.  
I have many logs between 04:43 to 07:10 but dashboard cannot recognize that logs.

 ![kibana_dashboard](https://us1.discourse-cdn.com/elastic/original/3X/f/e/feb6f09d09df7362c343ffbdf2c3aaca87869518.png)

 ![kibana_dashboard_02](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c798d12f0918bfef7933c7245f7be6b9aafb02b.jpeg)

here is my config

/etc/filebeat/filebeat.yml

> ```
> filebeat.inputs:
> - type: log
> enabled: true
> paths:
> - /var/log/secure*
> - /var/log/messages*
> - /var/log/yum.log*
> - /var/log/maillog*
> - /var/log/cron*
> filebeat.config.modules:
> path: ${path.config}/modules.d/*.yml
> reload.enabled: true
> reload.period: 10s
> setup.template.settings:
> index.number_of_shards: 1
> setup.kibana:
> host: "snip"
> cloud.id: starwars:snip
> output.elasticsearch:
> hosts: ["snip"]
> protocol: "https"
> username: "elastic"
> password: "snip"
> processors:
> - add_host_metadata: ~
> - add_cloud_metadata: ~
> 
> ```

/etc/filebeat/modules.d/system.yml

> ```
> - module: system
> syslog:
> enabled: true
> var.paths: ["/var/log/messages*"]
> auth:
> enabled: true
> var.paths: ["/var/log/secure*"]
> var.convert_timezone: true
> 
> ```

anyone know why this situations?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 20, 2018, 2:12pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249/2 "2018-11-20T14:12:32Z")

</div>

@Hoon_Cho

Looking at your configuration and your error message, I think the following is happening,  
your manual configuration and system module are watching the same files.

if you remove the following lines in your defined inputs it should solve the problem.

```auto
 - /var/log/secure*
- /var/log/messages*
```

---

<div class="post-metadata">

**Author:** ![Hoon\_Cho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoon_cho/32/52426_2.png) [@Hoon\_Cho](https://discuss.elastic.co/u/Hoon_Cho)\
**Post date:** [November 20, 2018, 2:45pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249/3 "2018-11-20T14:45:57Z")

</div>

thanks for reply

you mean that remove paths from filebeat.yml? not in system.yml

like this?

`/etc/filebeat/filebeat.yml`

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/yum.log*
    - /var/log/maillog*
    - /var/log/cron*
```

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 20, 2018, 2:55pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249/4 "2018-11-20T14:55:10Z")

</div>

@Hoon_Cho Yes exactly

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2018, 2:55pm UTC](https://discuss.elastic.co/t/error-creating-input-can-only-start-an-input-when-all-related-states-are-finished/157249/5 "2018-12-18T14:55:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.