# Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:test, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, **URL:** \ **Category:** Logstash\ **Created:** [January 9, 2020, 8:15pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486 "2020-01-09T20:15:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [January 9, 2020, 8:15pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/1 "2020-01-09T20:15:08Z")
I am not sure why is the if[fields][log\_type] throwing error here Here is the error my pipeline.conf file is giving below ```auto [2020-01-09T11:51:31,810][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:test, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 12, column 10 (byte 257) after filter {\n if[fields][log_type] ==\"access\"{\n grok {\n\tmatch => {\"message\" => \"%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA} %{NONNEGINT:threadId}\"}\n } else ", :backtrace=>["/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/java_pipeline.rb:26:in `initialize'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]} ``` Pipeline.conf- ```auto input { beats { port => 5044 } } filter { if[fields][log_type] =="access"{ grok { match => {"message" => "%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA} %{NONNEGINT:threadId}"} } else if [fields][log_type] == "errors" { grok { match => { "message" => "%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA:message}" } } }else [fields][log_type] == "dispatch" { grok { match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\[%{DATA:threadId}]%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{JAVACLASS:javaClass}%{SPACE}-%{SPACE}?(\[%{NONNEGINT:incidentId}])%{GREEDYDATA:message}" } } } } output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false ilm_enabled => false index => "%{log_type}-%{+YYYY.MM.dd}" } stdout { codec => rubydebug } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 9, 2020, 8:26pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/2 "2020-01-09T20:26:54Z")
> [@Mehak\_Bhargava](#): > > else [fields][log\_type] == "dispatch" That should be "else if", not just "else" ---
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [January 9, 2020, 8:41pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/3 "2020-01-09T20:41:25Z")
@Badger, I made the above change and still have this error ```auto [2020-01-09T12:34:36,429][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:test, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 12, column 10 (byte 257) after filter {\n if[fields][log_type] ==\"access\"{\n grok {\n\tmatch => {\"message\" => \"%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA} %{NONNEGINT:threadId}\"}\n } else ", :backtrace=>["/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/java_pipeline.rb:26:in `initialize'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/home/mehak/Documents/logstash-7.4.0/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]} ``` Here it states that line 12, which is the else if line has the error thrown at. ```auto filter { if[fields][log_type] =="access"{ grok { match => {"message" => "%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA} %{NONNEGINT:threadId}"} } else if [fields][log_type] == "errors" { grok { match => { "message" => "%{DATESTAMP:timestamp} %{NONNEGINT:code} %{GREEDYDATA} %{LOGLEVEL} %{NONNEGINT:anum} %{GREEDYDATA:message}" } } }else if [fields][log_type] == "dispatch" { grok { match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\[%{DATA:threadId}]%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{JAVACLASS:javaClass}%{SPACE}-%{SPACE}?(\[%{NONNEGINT:incidentId}])%{GREEDYDATA:message}" } } } } ``` Above is the updated block ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 9, 2020, 8:47pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/4 "2020-01-09T20:47:39Z")
You are missing a } to close your grok filter. ---
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [January 9, 2020, 9:32pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/6 "2020-01-09T21:32:03Z")
@Badger, there is no error thrown in filter block but still in kibana the message as it should be outputted after extracting timestamp, and all isn't shown. So why is the grok pattern not working? Below is the message I am getting instead of ```auto 08/10/2019 12:32:18 608 (null) INFO 60 Leftside Filter Expression : SubCategory="ATA VTA Reported" AND SourceProblemName="Touch Screen" for User ZK0DUBO Item Count : 7 ``` Instead of this for instance ```auto { "code": "774", "anum": "61", "message": "Leftside Filter Expression : IncidentType=1 AND StatusCode=\"01\" for User ZKH481F", "timestamp": "08/10/2019 12:38:09" } ``` ```auto ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2020, 9:32pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486/7 "2020-02-06T21:32:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.