# Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil **URL:** \ **Category:** Elasticsearch\ **Created:** [August 4, 2023, 8:39am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116 "2023-08-04T08:39:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ItsGautam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsgautam/32/128206_2.png) [@ItsGautam](https://discuss.elastic.co/u/ItsGautam)\ **Post date:** [August 4, 2023, 8:39am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116/1 "2023-08-04T08:39:25Z")
Hi, I am new to the elasticsearch. i ve tried to find the solution but ...... [2023-08-04T13:09:08,778][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=\>"main"} [2023-08-04T13:09:08,806][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil} [2023-08-04T13:09:08,847][DEBUG][logstash.instrument.periodicpoller.os] Stopping [2023-08-04T13:09:08,856][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping [2023-08-04T13:09:08,857][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping [2023-08-04T13:09:08,858][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Stopping [2023-08-04T13:09:08,863][DEBUG][logstash.agent] Shutting down all pipelines {:pipelines\_count=\>0} [2023-08-04T13:09:08,865][DEBUG][logstash.agent] Converging pipelines state {:actions\_count=\>0} [2023-08-04T13:09:08,903][DEBUG][logstash.agent] API WebServer has stopped running [2023-08-04T13:09:08,903][INFO][logstash.runner] Logstash shut down. [2023-08-04T13:09:08,914][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby.jar:?] at C\_3a\_.MicroservicesLogFiles.logstash\_minus\_8\_dot\_1\_dot\_0.lib.bootstrap.environment.(C:\MicroservicesLogFiles\logstash-8.1.0\lib\bootstrap\environment.rb:94) ~[?:?] ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 4, 2023, 1:00pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116/2 "2023-08-04T13:00:57Z")
Hello, You need to provide more context of your issue, avoid using the log error as the topic title. What are you trying to do? How are you running logstash? What does your logstash configuration looks like? ---
**Author:** ![ItsGautam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsgautam/32/128206_2.png) [@ItsGautam](https://discuss.elastic.co/u/ItsGautam)\ **Post date:** [August 7, 2023, 5:28am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116/5 "2023-08-07T05:28:55Z")
Hi , I am trying to send log files from logstash to elasticsearch whenever i have tried to run the conf file in the cmd it is getting exception my conf file looks like input { file { start\_position=\>"beginning" type =\> "logs" path =\> "C:/elk/elk-stack.log" sincedb\_path =\> "NUL" sincedb\_write\_interval =\>5 ```auto codec => multiline { pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*" negate => "true" what => "previous" or "next" } ``` } } filter { #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace if [message] =~ "\tat" { grok { match =\> ["message", "^(\tat)"] add\_tag =\> ["stacktrace"] } } grok { match =\> [ "message", "(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- [(?[A-Za-z0-9-]+)] [A-Za-z0-9.]_.(?[A-Za-z0-9#\_]+)\s_:\s+(?._)", "message", "(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?._)" ] } date { match =\> ["timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"] } } output { stdout { codec =\> rubydebug } # Sending properly parsed log events to elasticsearch elasticsearch { hosts =\> ["[https://localhost:9200](https://localhost:9200/)"] index =\> "intranetlogsapp" user =\> "elastic" password =\> "PBGPark8+coiwZ1\*l3SM" ~~}~~ ~~}~~ ---
**Author:** ![ItsGautam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itsgautam/32/128206_2.png) [@ItsGautam](https://discuss.elastic.co/u/ItsGautam)\ **Post date:** [August 7, 2023, 5:30am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116/6 "2023-08-07T05:30:44Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b81abfa1749bfe2000bca9386719831174f64be3.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2023, 5:31am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/340116/7 "2023-09-04T05:31:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.