Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil

I am new to the elasticsearch. i ve tried to find the solution but ......

[2023-08-04T13:09:08,778][INFO ][logstash.javapipeline ][main] Pipeline terminated {""=>"main"}
[2023-08-04T13:09:08,806][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[2023-08-04T13:09:08,847][DEBUG][logstash.instrument.periodicpoller.os] Stopping
[2023-08-04T13:09:08,856][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping
[2023-08-04T13:09:08,857][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping
[2023-08-04T13:09:08,858][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Stopping
[2023-08-04T13:09:08,863][DEBUG][logstash.agent ] Shutting down all pipelines {:pipelines_count=>0}
[2023-08-04T13:09:08,865][DEBUG][logstash.agent ] Converging pipelines state {:actions_count=>0}
[2023-08-04T13:09:08,903][DEBUG][logstash.agent ] API WebServer has stopped running
[2023-08-04T13:09:08,903][INFO ][logstash.runner ] Logstash shut down.
[2023-08-04T13:09:08,914][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/ ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/ ~[jruby.jar:?]
at C_3a_.MicroservicesLogFiles.logstash_minus_8_dot_1_dot_0.lib.bootstrap.environment.(C:\MicroservicesLogFiles\logstash-8.1.0\lib\bootstrap\environment.rb:94) ~[?:?]


You need to provide more context of your issue, avoid using the log error as the topic title.

What are you trying to do? How are you running logstash? What does your logstash configuration looks like?

1 Like

Hi ,
I am trying to send log files from logstash to elasticsearch whenever i have tried to run the conf
file in the cmd it is getting exception
my conf file looks like
input {

file {
type => "logs"
path => "C:/elk/elk-stack.log"
sincedb_path => "NUL"
sincedb_write_interval =>5

codec => multiline {
  pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*"
  negate => "true"
  what => "previous" or "next"


filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]

grok {
match => [ "message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- [(?[A-Za-z0-9-]+)] [A-Za-z0-9.].(?[A-Za-z0-9#_]+)\s:\s+(?.)",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?.

date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]

output {

stdout {
codec => rubydebug


Sending properly parsed log events to elasticsearch

elasticsearch {
hosts => ["https://localhost:9200"]
index => "intranetlogsapp"
user => "elastic"
password => "PBGPark8+coiwZ1*l3SM"


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.