, action_result: false", :backtrace=>nil}
```
Here is my configs:
01\_input.conf:
```auto
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/logstash/conf.d/certs/logstash-forwarder.crt"
ssl_key => "/etc/logstash/conf.d/certs/logstash-forwarder.key"
}
}
```
23\_outputs.conf:
```auto
output {
if "%ASA-" in [message] {
s3 {
access_key_id => "Removed"
secret_access_key => "Removed"
region => "us-east-1"
bucket => "logs"
prefix => "logs/cisco-asa/%{+YYYY}/%{+MM}/%{+dd}"
size_file => "500000000"
time_file => "5"
codec => "json_lines"
storage_class => "STANDARD"
}
}
if [pan_type] == "TRAFFIC" {
s3 {
access_key_id => "Removed"
secret_access_key => "Removed"
region => "us-east-1"
bucket => "logs"
prefix => "logs/palo-alto/%{+YYYY}/%{+MM}/%{+dd}"
size_file => "500000000"
time_file => "5"
codec => "json_lines"
storage_class => "STANDARD"
}
}
else if [pan_type] == "THREAT" {
s3 {
access_key_id => "Removed"
secret_access_key => "Removed"
region => "us-east-1"
bucket => "logs"
prefix => "logs/palo-alto/%{+YYYY}/%{+MM}/%{+dd}"
size_file => "500000000"
time_file => "5"
codec => "json_lines"
storage_class => "STANDARD"
}
}
else if [pan_type] == "SYSTEM" {
s3 {
access_key_id => "Removed"
secret_access_key => "Removed"
region => "us-east-1"
bucket => "logs"
prefix => "logs/palo-alto/%{+YYYY}/%{+MM}/%{+dd}"
size_file => "500000000"
time_file => "5"
codec => "json_lines"
storage_class => "STANDARD"
}
}
}
```
logstash.yml:
```auto
node.name: logstash
path.data: /var/lib/logstash
log.level: info
path.logs: /var/log/logstash
```
FWIW I am using an AWS instance with Ubuntu 18.04 installed
---
### Author:  [@Feedy](https://discuss.elastic.co/u/Feedy)
#### Post date: [August 19, 2020, 2:59pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/2 "2020-08-19T14:59:57Z")
error message seems to point to pipeline file but I don't see any issues with it.
pipeline.yml:
```auto
- pipeline.id: main
path.config: "/etc/logstash/conf.d/*.conf"
```
---
### Author:  [@Feedy](https://discuss.elastic.co/u/Feedy)
#### Post date: [August 19, 2020, 5:50pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/3 "2020-08-19T17:50:17Z")
could this be a permissions issue? from the error message it appears to be saying its not successful with creating pipeline main.
What should the permissions be for logstash directory?
Here is what I currently have set:
```auto
-rw-r--r-- 1 logstash logstash 10706 Aug 19 16:23 logstash.yml
-rw-r--r-- 1 logstash logstash 285 Aug 11 23:57 pipelines.yml
```
@aaron-nimocks @Badger
---
### Author:  [@Feedy](https://discuss.elastic.co/u/Feedy)
#### Post date: [August 19, 2020, 6:39pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/4 "2020-08-19T18:39:07Z")
I created a new conf file titled ifo.conf and tried the following config and it works:
```auto
input {
beats {
port => 5044
}
}
output {
stdout { }
}
```
So I believe its pointing to a permissions issue just not sure what is actually the issue with the permissions I have set. The permissions are the same for the new conf file I just created and the conf files I want to use, see below:
```auto
-rw-r--r-- 1 logstash logstash 221 Aug 19 18:17 01_input.conf
-rw-r--r-- 1 logstash logstash 8469 Aug 19 15:48 02_cisco-asa.conf
-rw-r--r-- 1 logstash logstash 6719 Aug 19 15:48 03_palo-alto.conf
-rw-r--r-- 1 logstash logstash 2620 Aug 19 15:49 10_output.conf
```
```auto
-rw-r--r-- 1 logstash logstash 96 Aug 19 18:31 ifo.conf
```
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [August 19, 2020, 7:19pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/5 "2020-08-19T19:19:40Z")
I'd just start doing step by step testing.
```auto
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/logstash/conf.d/certs/logstash-forwarder.crt"
ssl_key => "/etc/logstash/conf.d/certs/logstash-forwarder.key"
}
}
output {
stdout { }
}
```
Run this and does it work? If so you verified the input. Then do the filter if you have one. Then 1 by 1 add in the output until you hit the error.
I know it doesn't sound fun but nothing is really sticking out to me at a quick look.
---
### Author:  [@Feedy](https://discuss.elastic.co/u/Feedy)
#### Post date: [August 19, 2020, 7:51pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/6 "2020-08-19T19:51:19Z")
Thanks for the suggestion. I went through each filter conf file I want to use and the culprit was the ciscoasa conf file. Nothing was actually wrong with that conf file but I remembered that I added additional cisco firewall tags to my grok pattern which in turn I had to update the firewalls pattern file.
For anybody else that come across this issue make sure you double check the firewalls file located at /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns to make sure each ciscotag you use in your filter is listed in that file.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 16, 2020, 7:51pm UTC](https://discuss.elastic.co/t/failed-to-execute-action/245517/7 "2020-09-16T19:51:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.