Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil

[ItsGautam (Gautam)]

Hi,
I am new to the elasticsearch. i ve tried to find the solution but ......

[2023-08-04T13:09:08,778][INFO ][logstash.javapipeline ][main] Pipeline terminated {"pipeline.id"=>"main"}
[2023-08-04T13:09:08,806][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[2023-08-04T13:09:08,847][DEBUG][logstash.instrument.periodicpoller.os] Stopping
[2023-08-04T13:09:08,856][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping
[2023-08-04T13:09:08,857][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping
[2023-08-04T13:09:08,858][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Stopping
[2023-08-04T13:09:08,863][DEBUG][logstash.agent ] Shutting down all pipelines {:pipelines_count=>0}
[2023-08-04T13:09:08,865][DEBUG][logstash.agent ] Converging pipelines state {:actions_count=>0}
[2023-08-04T13:09:08,903][DEBUG][logstash.agent ] API WebServer has stopped running
[2023-08-04T13:09:08,903][INFO ][logstash.runner ] Logstash shut down.
[2023-08-04T13:09:08,914][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby.jar:?]
at C_3a_.MicroservicesLogFiles.logstash_minus_8_dot_1_dot_0.lib.bootstrap.environment.(C:\MicroservicesLogFiles\logstash-8.1.0\lib\bootstrap\environment.rb:94) ~[?:?]

[leandrojmp (Leandro Pereira)]

Hello,

You need to provide more context of your issue, avoid using the log error as the topic title.

What are you trying to do? How are you running logstash? What does your logstash configuration looks like?

[ItsGautam (Gautam)]

Hi ,
I am trying to send log files from logstash to elasticsearch whenever i have tried to run the conf
file in the cmd it is getting exception
my conf file looks like
input {

file {
start_position=>"beginning"
type => "logs"
path => "C:/elk/elk-stack.log"
sincedb_path => "NUL"
sincedb_write_interval =>5

codec => multiline {
  pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*"
  negate => "true"
  what => "previous" or "next"
}

}
}

filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}

grok {
match => [ "message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- [(?[A-Za-z0-9-]+)] [A-Za-z0-9.].(?[A-Za-z0-9#_]+)\s:\s+(?.)",
"message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?.)"
]
}

date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
}
}

output {

stdout {
codec => rubydebug

}

Sending properly parsed log events to elasticsearch

elasticsearch {
hosts => ["https://localhost:9200"]
index => "intranetlogsapp"
user => "elastic"
password => "PBGPark8+coiwZ1*l3SM"

}
}

[ItsGautam (Gautam)]