# \[FATAL\] An unexpected error occured

**URL:** <https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216>\
**Category:** Logstash\
**Created:** [September 20, 2017, 4:53pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216 "2017-09-20T16:53:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Louise](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@Louise](https://discuss.elastic.co/u/Louise)\
**Post date:** [September 20, 2017, 4:53pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/1 "2017-09-20T16:53:12Z")

</div>

I am new with the Elasticsearch stak and I have a fatal error when trying to configure Logstash since I have deleted and re-downloaded it. It used to work but I thought the connection with Elasticsearch and Kibana was strange since I could not see any data so I have chose to erase and re-install the whole stack. Since then, when I am doing the bin/logstash -f myconfig.conf I have this error :

[FATAL] 2017-09-20 18:47:55.640 [main] runner - An unexpected error occurred! {:error=\>java.lang.IllegalArgumentException: Illegal character in path at index 18: file:///C:/Program  
Files/Elastic/logstash-5.6.1/logstash-5.6.1/config/log4j2.properties, :backtrace=\>["java.net.URI.create(java/net/URI.java:852)", "java.lang.reflect.Method.invoke(java/lang/reflect  
/Method.java:498)", "RUBY.reconfigure(C:/Program Files/Elastic/logstash-5.6.1/logstash-5.6.1/logstash-core/lib/logstash/logging/logger.rb:78)", "org.jruby.ext.thread.Mutex.synchron  
ize(org/jruby/ext/thread/Mutex.java:149)", "RUBY.reconfigure(C:/Program Files/Elastic/logstash-5.6.1/logstash-5.6.1/logstash-core/lib/logstash/logging/logger.rb:77)", "RUBY.execute  
(C:/Program Files/Elastic/logstash-5.6.1/logstash-5.6.1/logstash-core/lib/logstash/runner.rb:224)", "RUBY.run(C:/Program Files/Elastic/logstash-5.6.1/logstash-5.6.1/vendor/bundle/j  
ruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67)", "RUBY.run(C:/Program Files/Elastic/logstash-5.6.1/logstash-5.6.1/logstash-core/lib/logstash/runner.rb:204)", "RUBY.run(C:/Progr  
am Files/Elastic/logstash-5.6.1/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132)", "C\_3a\_.Program\_20\_Files.Elastic.logstash\_minus\_5\_dot\_6\_dot\_1.log  
stash\_minus\_5\_dot\_6\_dot\_1.lib.bootstrap.environment.(root)(C:\Program Files\Elastic\logstash-5.6.1\logstash-5.6.1\lib\bootstrap\environment.rb:71)", "C\_3a\_.Program\_20\_Files.  
Elastic.logstash\_minus\_5\_dot\_6\_dot\_1.logstash\_minus\_5\_dot\_6\_dot\_1.lib.bootstrap.environment.(root)(C\_3a\_/Program\_20\_Files/Elastic/logstash\_minus\_5\_dot\_6\_dot\_1/logstash\_minus\_5\_dot\_  
6\_dot\_1/lib/bootstrap/C:\Program Files\Elastic\logstash-5.6.1\logstash-5.6.1\lib\bootstrap\environment.rb:71)"]}

Does anyone know why or have had the same error ?  
Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2017, 12:38am UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/2 "2017-09-21T00:38:27Z")

</div>

> [@Louise](#):
>
> Illegal character in path at index 18: file:///C:/Program
> 
> Files/Elastic/logstash-5.6.1/logstash-5.6.1/config/log4j2.properties

What's the content of that file?

If you paste it, please make sure you format it using the `</>` button.

---

<div class="post-metadata">

**Author:** ![saikat17ster](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@saikat17ster](https://discuss.elastic.co/u/saikat17ster)\
**Post date:** [September 21, 2017, 11:05am UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/3 "2017-09-21T11:05:18Z")

</div>

Hi Lousie,  
I too getting same issue.

---

<div class="post-metadata">

**Author:** ![Louise](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@Louise](https://discuss.elastic.co/u/Louise)\
**Post date:** [September 21, 2017, 12:20pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/4 "2017-09-21T12:20:59Z")

</div>

Saikat : I just delete and re-download logstash and it is working better now though it was way more difficult to dezip the file doesn't know why...

Warkolm : My log4j2.properties in my new download is like that :

```
> status = error
> name = LogstashPropertiesConfig
> 
> appender.console.type = Console
> appender.console.name = plain_console
> appender.console.layout.type = PatternLayout
> appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
> 
> appender.json_console.type = Console
> appender.json_console.name = json_console
> appender.json_console.layout.type = JSONLayout
> appender.json_console.layout.compact = true
> appender.json_console.layout.eventEol = true
> 
> appender.rolling.type = RollingFile
> appender.rolling.name = plain_rolling
> appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
> appender.rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
> appender.rolling.policies.type = Policies
> appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
> appender.rolling.policies.time.interval = 1
> appender.rolling.policies.time.modulate = true
> appender.rolling.layout.type = PatternLayout
> appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %-.10000m%n
> 
> appender.json_rolling.type = RollingFile
> appender.json_rolling.name = json_rolling
> appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
> appender.json_rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
> appender.json_rolling.policies.type = Policies
> appender.json_rolling.policies.time.type = TimeBasedTriggeringPolicy
> appender.json_rolling.policies.time.interval = 1
> appender.json_rolling.policies.time.modulate = true
> appender.json_rolling.layout.type = JSONLayout
> appender.json_rolling.layout.compact = true
> appender.json_rolling.layout.eventEol = true
> 
> 
> rootLogger.level = ${sys:ls.log.level}
> rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
> rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling
> 
> # Slowlog
> 
> appender.console_slowlog.type = Console
> appender.console_slowlog.name = plain_console_slowlog
> appender.console_slowlog.layout.type = PatternLayout
> appender.console_slowlog.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
> 
> appender.json_console_slowlog.type = Console
> appender.json_console_slowlog.name = json_console_slowlog
> appender.json_console_slowlog.layout.type = JSONLayout
> appender.json_console_slowlog.layout.compact = true
> appender.json_console_slowlog.layout.eventEol = true
> 
> appender.rolling_slowlog.type = RollingFile
> appender.rolling_slowlog.name = plain_rolling_slowlog
> appender.rolling_slowlog.fileName = ${sys:ls.logs}/logstash-slowlog-${sys:ls.log.format}.log
> appender.rolling_slowlog.filePattern = ${sys:ls.logs}/logstash-slowlog-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
> appender.rolling_slowlog.policies.type = Policies
> appender.rolling_slowlog.policies.time.type = TimeBasedTriggeringPolicy
> appender.rolling_slowlog.policies.time.interval = 1
> appender.rolling_slowlog.policies.time.modulate = true
> appender.rolling_slowlog.layout.type = PatternLayout
> appender.rolling_slowlog.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %.10000m%n
> 
> appender.json_rolling_slowlog.type = RollingFile
> appender.json_rolling_slowlog.name = json_rolling_slowlog
> appender.json_rolling_slowlog.fileName = ${sys:ls.logs}/logstash-slowlog-${sys:ls.log.format}.log
> appender.json_rolling_slowlog.filePattern = ${sys:ls.logs}/logstash-slowlog-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
> appender.json_rolling_slowlog.policies.type = Policies
> appender.json_rolling_slowlog.policies.time.type = TimeBasedTriggeringPolicy
> appender.json_rolling_slowlog.policies.time.interval = 1
> appender.json_rolling_slowlog.policies.time.modulate = true
> appender.json_rolling_slowlog.layout.type = JSONLayout
> appender.json_rolling_slowlog.layout.compact = true
> appender.json_rolling_slowlog.layout.eventEol = true
> 
> logger.slowlog.name = slowlog
> logger.slowlog.level = trace
> logger.slowlog.appenderRef.console_slowlog.ref = ${sys:ls.log.format}_console_slowlog
> logger.slowlog.appenderRef.rolling_slowlog.ref = ${sys:ls.log.format}_rolling_slowlog
> logger.slowlog.additivity = false
```

---

<div class="post-metadata">

**Author:** ![saikat17ster](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@saikat17ster](https://discuss.elastic.co/u/saikat17ster)\
**Post date:** [September 21, 2017, 1:04pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/5 "2017-09-21T13:04:42Z")

</div>

Thanks Lousie  
In my case the issue was with the folder name where i extracted the logstash . My folder structure was ELK Stack\>Logstash\>bin.  
The space between "ELK Stack" folder name was creating issue in running the logstash.bat file.  
I renamed the folder to ELK\_Stack\>Logstash\>bin and kept the logstash.config file in Config folder.  
Now it's working.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2017, 9:21pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/6 "2017-09-21T21:21:26Z")

</div>

@saikat17ster FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2017, 9:21pm UTC](https://discuss.elastic.co/t/fatal-an-unexpected-error-occured/101216/7 "2017-10-19T21:21:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.