# \[ERROR\]logstash.pipeline - the trustAnchors parameter must be non-empty **URL:** \ **Category:** Logstash\ **Created:** [July 26, 2019, 5:45pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485 "2019-07-26T17:45:13Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![victor\_ide](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_ide/32/50770_2.png) [@victor\_ide](https://discuss.elastic.co/u/victor_ide)\ **Post date:** [July 26, 2019, 5:45pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485/1 "2019-07-26T17:45:13Z")
Hey guys, I'm trying to create different indexes based on a field added using the processors. So in the winlogbeat file I added the fields: > processors: > > - add\_tags: > tags: [internal, lab] > target: "environment" And I'm trying to create a specific index based in these fields. My output.conf > output { > if "internal" in [environment] and "%{[@metadata][beat]}" == "winlogbeat" { > elasticsearch { > hosts =\> ["[https://192.168.112.114:9200](https://192.168.112.114:9200)"] > cacert =\> '/etc/logstash/certs/ca.crt' > user =\> "lab\_writer" > password =\> "REDACTED" > index =\> "lab-windows-%{+dd.MM.YYYY}" > } > } else { > elasticsearch { > hosts =\> ["[https://192.168.112.114:9200](https://192.168.112.114:9200)"] > cacert =\> '/etc/logstash/certs/ca.crt' > user =\> "logstash\_internal" > password =\> "REDACTED" > index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" > } > } > stdout { codec =\> rubydebug } > } but my logstash is running the following error: > Jul 26 14:42:02 logstash logstash[19035]: [2019-07-26T14:42:02,244][ERROR][logstash.javapipeline] Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:74:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform\_request\_to\_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:245:in `block in healthcheck!'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:241:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:341:in `update\_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:71:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:302:in `build\_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client.rb:64:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:103:in `create\_http\_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http\_client\_builder.rb:99:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch.rb:238:in `build\_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/common.rb:25:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:106:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:48:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:192:in `block in register\_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:191:in `register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:462:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:204:in `start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:146:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:105:in `block in start'"], :thread=\>"#\"} > Jul 26 14:42:02 logstash logstash[19035]: [2019-07-26T14:42:02,249][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil} It is the best way to do it? thanks in advanced! ---
**Author:** ![victor\_ide](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_ide/32/50770_2.png) [@victor\_ide](https://discuss.elastic.co/u/victor_ide)\ **Post date:** [July 29, 2019, 2:34pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485/2 "2019-07-29T14:34:52Z")
Okay so answering myself: the error was in the CA file, that was empty. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 26, 2019, 2:35pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-the-trustanchors-parameter-must-be-non-empty/192485/3 "2019-08-26T14:35:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.