# Error creating runner from config: failed to create input: Can only start an input when all related states are finished:

**URL:** <https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 13, 2021, 9:24am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328 "2021-08-13T09:24:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lilyyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lilyyy/32/51129_2.png) [@lilyyy](https://discuss.elastic.co/u/lilyyy)\
**Post date:** [August 13, 2021, 9:24am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328/1 "2021-08-13T09:24:22Z")

</div>

Hi all

I get the logs from suricata(eve.json) so I've enabled suricata module in filebeat.  
But whenever I start filebeat, I got this error.

```auto
2021-08-13T18:11:18.650+0900 ERROR [reload] cfgfile/list.go:99 Error creating runner from config: failed to create input: Can only start an input when all related states are finished: {Id: native::12216862-129, Finished: false, Fileinfo: &{eve.json 4732 420 {802951655 63764442666 0x562c8bea5e40} {129 12216862 1 33188 0 0 0 0 4732 4096 16 {1628845832 278954369} {1628845866 802951655} {1628845866 802951655} [0 0 0]}}, Source: /var/log/suricata/eve.json, Offset: 9464, Timestamp: 2021-08-13 18:11:16.677225147 +0900 KST m=+89.312697257, TTL: -1ns, Type: log, Meta: map[], FileStateOS: 12216862-129}

```

I think because of this error, the filebeat module is not working well so logs were not parsed.  
this is my filebeat.yml

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
   - /var/log/suricata/eve.json
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true #false

setup.dashboards.enabled: true
setup.kibana.host: "http://kibana:5601"

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]
  username: elastic
  password: password
setup.ilm.enabled: false
setup.ilm.check_exists: false

```

this is dockerfile for filebeat

```auto
FROM docker.elastic.co/beats/filebeat:7.13.4
#COPY ${pwd}/config/filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml
RUN filebeat modules enable suricata
USER filebeat

```

this is part of filebeat in docker-compose.yml.

```auto
  filebeat:
    build:
      context: filebeat/
    user: root
    volumes:
      - /var/lib/docker:/var/lib/docker:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - {pwd}/test_elk/filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml
      - {pwd}/test_elk/suricata/test_suricata_5.0/log:/var/log/suricata
    entrypoint: "filebeat -e -strict.perms=false"
    privileged: true
    networks:
      - elk

```

I don't know how can I solve this problem.  
what is the problem and how can I solve this problem?

Thanks.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [August 13, 2021, 10:31am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328/2 "2021-08-13T10:31:30Z")

</div>

Can u post the config for the suricata module too? It looks like ur using a normal log input to read the suricata logs, not the module. Are u using both? If so that may be causing issues if filebeat is trying to read it with both.

---

<div class="post-metadata">

**Author:** ![lilyyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lilyyy/32/51129_2.png) [@lilyyy](https://discuss.elastic.co/u/lilyyy)\
**Post date:** [August 17, 2021, 4:34am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328/3 "2021-08-17T04:34:50Z")

</div>

Yes, your right.  
I put the same log input path both filebeat and module configuration.  
I solve the problem when I remove one log input.

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2021, 6:35am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-failed-to-create-input-can-only-start-an-input-when-all-related-states-are-finished/281328/4 "2021-09-14T06:35:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.