# Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 6, **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2019, 1:32am UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387 "2019-04-18T01:32:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Apurva\_Ganthi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurva_ganthi/32/42607_2.png) [@Apurva\_Ganthi](https://discuss.elastic.co/u/Apurva_Ganthi)\ **Post date:** [April 18, 2019, 1:32am UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387/1 "2019-04-18T01:32:39Z")
Hello, My code for the logstash-simple.conf file is as follows:- input { file { type =\> "mylog" path =\> "C:\Softwares\ELK\custom-\*.log" mode =\> "tail" start\_ position =\> "beginning" } } ``` filter { if ([type]= "mylog") { grok { match => { "message" => [ " (?%{MONTHDAY)-%{MONTH)-%{YEAR )%{TIME )%{WORD))\t (?%{WORD)%{WORD)%{WORD))\t%{NOMBER :Argl)\t%{NOMBER :Arg2)\t%{WORD:Operation)\t%{GREEDYDATA :params)", " (?%{MONTHDAY)-%{MONTH)-%{YEAR )%{TIME )%{WORD))\t (?%{WORD)%{WORD))\t%{NOMBER :Argl)\t%{NOMBER :Arg2)\t%{WORD:Operation)", " (?%{MONTHDAY)-%{MONTH)-%{YEAR) l%1TIME) %{WORD))\t (?%{WORD))\t%{NOMBER :Argl)\t%{NOMBER :Arg2)\t%{WORD:Operation)" ] } } if ([Message] == "custommessage") { mutate { add_field => ["NewField", "Hello"] } } else if ([Message] == "another message") { mutate { split => ["Message" , " "] add_field => ["FirstPart", "%{[Message][0]}", "SecondPart", "%{[Message][0]}" ] } } else if ([Message] == "one more message") { grok { match => ["params", "%{WORD:Arg3)\t%{WORD:Arg4)\t%{WORD:Arg5)"] } } mutate { remove_field => ["params"] } } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` The error i am getting in the logs is as follows:- [2019-04-18T06:55:15,823][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2019-04-18T06:55:15,852][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.0.0"} [2019-04-18T06:55:17,169][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 6, column 10 (byte 108) after input {\r\n\tfile {\r\n\t\ttype =\> "mylog"\r\n\t\tpath =\> "C:\Softwares\ELK\custom-\*.log"\r\n\t\tmode =\> "tail"\r\n\t\tstart\_ ", :backtrace=\>["C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/java_pipeline.rb:23:in`initialize'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "C:/Softwares/ELK/Logstash/logstash-7.0.0/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]} [2019-04-18T06:55:17,802][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2019-04-18T06:55:22,727][INFO][logstash.runner] Logstash shut down. ---
**Author:** ![staodd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/staodd/32/24509_2.png) [@staodd](https://discuss.elastic.co/u/staodd)\ **Post date:** [April 18, 2019, 2:27am UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387/2 "2019-04-18T02:27:40Z")
Your path is wrong I think. If I'm not mistaken you have to use / on Windows as well as Unix. So : C:/Software/ELK/custom-\*.log ---
**Author:** ![Apurva\_Ganthi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apurva_ganthi/32/42607_2.png) [@Apurva\_Ganthi](https://discuss.elastic.co/u/Apurva_Ganthi)\ **Post date:** [April 18, 2019, 3:49am UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387/3 "2019-04-18T03:49:24Z")
Thanks a ton! It worked.. 🙂 ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 18, 2019, 1:03pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387/4 "2019-04-18T13:03:43Z")
> [@Apurva\_Ganthi](#): > > start\_ position Whilst it is true that you have to use / rather than , this specific error message is caused by the space between start\_ and position. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2019, 1:05pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-6/177387/5 "2019-05-16T13:05:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.