# ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 24, column 7 **URL:** \ **Category:** Logstash\ **Created:** [March 25, 2019, 9:43pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833 "2019-03-25T21:43:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sblancocr](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sblancocr](https://discuss.elastic.co/u/sblancocr)\ **Post date:** [March 25, 2019, 9:43pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/1 "2019-03-25T21:43:35Z")
Hi. I installed a logstash and show me next error log: [2019-03-25T15:36:16,145][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.6.1"} [2019-03-25T15:36:18,147][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 24, column 7 (byte 574) after output", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:327:in`block in converge\_state'"]} [2019-03-25T15:36:18,495][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} The config file is: input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/certificate.crt" ssl\_key =\> "/etc/pki/tls/private/certificate.key" client\_inactivity\_timeout =\> 0 } } filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output.logstash { elasticsearch { hosts =\> ["[http://serverName:9200](http://serverName:9200)"] index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } } The Elastic it's runing ![Captura%20de%20pantalla%20de%202019-03-25%2015-44-46](https://us1.discourse-cdn.com/elastic/original/3X/2/6/269d0cb98449758855fa17a3db75445e5ec27d4b.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 25, 2019, 9:44pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/2 "2019-03-25T21:44:53Z")
> [@sblancocr](#): > > output.logstash That should just be output. ---
**Author:** ![sblancocr](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sblancocr](https://discuss.elastic.co/u/sblancocr)\ **Post date:** [March 25, 2019, 9:52pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/3 "2019-03-25T21:52:48Z")
its result. but... show me other message.... See next log [2019-03-25T15:49:31,790][WARN][logstash.runner] SIGTERM received. Shutting down. [2019-03-25T15:49:35,983][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\"} [2019-03-25T15:50:19,556][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.6.1"} [2019-03-25T15:50:31,036][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} [2019-03-25T15:50:31,540][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200/](http://log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200/)]}} [2019-03-25T15:50:31,822][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200/](http://log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200/)"} [2019-03-25T15:50:31,932][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>6} [2019-03-25T15:50:31,937][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6} [2019-03-25T15:50:31,994][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200](https://log-elasticsearch-client-01.alpha.ci.ucr.ac.cr:9200)"]} [2019-03-25T15:50:32,007][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2019-03-25T15:50:32,039][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} [2019-03-25T15:50:33,265][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} [2019-03-25T15:50:33,324][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} [2019-03-25T15:50:33,407][INFO][org.logstash.beats.Server] Starting server on port: 5044 [2019-03-25T15:50:33,428][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [2019-03-25T15:50:33,875][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-03-25T15:50:45,089][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5044, remote: undefined] Handling exception: javax.net.ssl.SSLHandshakeException: error:1000009c:SSL routines:OPENSSL\_internal:HTTP\_REQUEST [2019-03-25T15:50:45,095][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:1000009c:SSL routines:OPENSSL\_internal:HTTP\_REQUEST at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:579) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:496) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_131] ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 25, 2019, 10:02pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/4 "2019-03-25T22:02:44Z")
Please do not post pictures of text, just post the text itself. ---
**Author:** ![sblancocr](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sblancocr](https://discuss.elastic.co/u/sblancocr)\ **Post date:** [March 25, 2019, 10:05pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/5 "2019-03-25T22:05:07Z")
Sorry... Ready... last message... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 25, 2019, 10:19pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/6 "2019-03-25T22:19:37Z")
It may be caused by a beat that is not configured to use SSL. Try turning off ssl on the beats input and see if you get any messages. If you do, go fix those hosts that are sending them to use SSL. Then re-enable SSL on the beats input. ---
**Author:** ![sblancocr](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sblancocr](https://discuss.elastic.co/u/sblancocr)\ **Post date:** [March 26, 2019, 2:47pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/7 "2019-03-26T14:47:40Z")
Thanks a lot... it's work... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 23, 2019, 2:47pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-24-column-7/173833/8 "2019-04-23T14:47:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.