# Fresh Install of 7.3.2 Crashes Creating Template

**URL:** <https://discuss.elastic.co/t/fresh-install-of-7-3-2-crashes-creating-template/201553>\
**Category:** Logstash\
**Created:** [September 30, 2019, 12:43am UTC](https://discuss.elastic.co/t/fresh-install-of-7-3-2-crashes-creating-template/201553 "2019-09-30T00:43:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hackdefendr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hackdefendr/32/54683_2.png) [@hackdefendr](https://discuss.elastic.co/u/hackdefendr)\
**Post date:** [September 30, 2019, 12:43am UTC](https://discuss.elastic.co/t/fresh-install-of-7-3-2-crashes-creating-template/201553/1 "2019-09-30T00:43:51Z")

</div>

I hate starting over from scratch, but upgrading from 6.8.3 to 7.3.2 did not go well. So I removed and purged my whole ELK system. I still have all my JSON logs, so I can import them without any issue.

With that said, my fresh install is crashing in the same place the upgrade did. This leads me to believe there is a problem with my configuration. I have run out of ideas and need the communities help to determine if this is a bug and where.

**logstash-stdout** : [https://pastebin.com/0yRWwH9K](https://pastebin.com/0yRWwH9K)

**logstash-stderr** : [https://pastebin.com/1xQEADsd](https://pastebin.com/1xQEADsd)

**My config** :

```
input {
       file {
              path => ["/home/cowrie/cowrie/var/log/cowrie/cowrie.json"]
              codec => json
              type => "cowrie"
       }
       tcp {
              port => 3333
              type => "cowrie"
       }
}

filter {
    if [type] == "cowrie" {
        date {
            match => ["timestamp", "ISO8601"]
        }
        if [src_ip] {
            mutate {
                add_field => { "src_host" => "%{src_ip}" }
            }
            dns {
                reverse => ["src_host"]
                nameserver => ["10.71.1.1", "1.1.1.1"]
                action => "replace"
                hit_cache_size => 4096
                hit_cache_ttl => 900
                failed_cache_size => 512
                failed_cache_ttl => 900
            }
                        geoip {
                                database => "/var/opt/logstash/vendor/geoip/GeoLite2-City.mmdb"
                        source => "src_ip"
                        target => "geoip"
                add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
                add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
                }
                        mutate {
                        convert => ["[geoip][coordinates]", "float" ]
                }
        }
    }
}

output {
    if [type] == "cowrie" {
        elasticsearch {
            hosts => ["localhost:9200"]
        }
        file {
            path => "/var/log/cowrie-logstash.log"
            codec => json
        }
    }
}

```

I'm hoping someone can spot why this is happening. Thank-you!

---

<div class="post-metadata">

**Author:** ![hackdefendr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hackdefendr/32/54683_2.png) [@hackdefendr](https://discuss.elastic.co/u/hackdefendr)\
**Post date:** [October 1, 2019, 1:26am UTC](https://discuss.elastic.co/t/fresh-install-of-7-3-2-crashes-creating-template/201553/2 "2019-10-01T01:26:05Z")

</div>

OMG. This whole thing was due to unnecessary configuration options in elasticsearch.yml. This whole time my local, single node ES cluster wasn't even starting all the wat. I removed everything but the very very basic configuration for both elasticsearch and logstash, now everything is running properly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2019, 1:26am UTC](https://discuss.elastic.co/t/fresh-install-of-7-3-2-crashes-creating-template/201553/3 "2019-10-29T01:26:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.