# Getting Failed Action error in logstash-plain.log **URL:** \ **Category:** Logstash\ **Created:** [September 28, 2017, 10:49am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101 "2017-09-28T10:49:23Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![meaniljangra](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Post date:** [September 28, 2017, 10:49am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/1 "2017-09-28T10:49:23Z")
I am sending the logs to ELK server from different system using filebeat. I am getting only one line log information in Kibana. Other logs are not present. I am sending more than 100 lines of logs. When I checked logstash-plain.log file, I found something wrong like this: ``` [2017-09-28T06:49:24,469][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500} [2017-09-28T06:49:25,169][WARN][logstash.inputs.beats] Beats input: SSL Certificate will not be used [2017-09-28T06:49:25,169][WARN][logstash.inputs.beats] Beats input: SSL Key will not be used [2017-09-28T06:49:25,169][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"} [2017-09-28T06:49:25,212][INFO][logstash.pipeline] Pipeline main started [2017-09-28T06:49:25,278][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2017-09-28T07:04:10,232][WARN][logstash.outputs.elasticsearch] Failed action. {:status=>409, :action=>["create", {:_id=>"%{[@metadata][computed_id]}", :_index=>"logstash-2017.09.28", :_type=>"log", :_routing=>nil}, 2017-09-28T06:03:54.530Z MyHostName[15/Mar/2017:07:27:40 +0000] [Module1=14%|Module2=07%|Module3=11%|Module4=15%|Module5=27%|Module6=27%|Module7=33%|Module8=51%]], :response=>{"create"=>{"_index"=>"logstash-2017.09.28", "_type"=>"log", "_id"=>"%{[@metadata][computed_id]}", "status"=>409, "error"=>{"type"=>"version_conflict_engine_exception", "reason"=>"[log][%{[@metadata][computed_id]}]: version conflict, document already exists (current version [1])", "index_uuid"=>"sGN1VTXOSFKSQ5ZvTlloDg", "shard"=>"4", "index"=>"logstash-2017.09.28"}}}} ``` The logs which I am sending to ELK using FIlebeat has the following format: ``` [15/Mar/2017:07:27:40 +0000] [Module1=14%|Module2=07%|Module3=11%|Module4=15%|Module5=27%|Module6=27%|Module7=33%|Module8=51%] [15/Mar/2017:07:27:40 +0000] [Module1=14%|Module2=07%|Module3=11%|Module4=15%|Module5=27%|Module6=27%|Module7=33%|Module8=51%] ``` In Kibana I've to see percentage of code coverage for all the modules individually. My logstash filter config file 10-filter.conf file is like this: ``` filter { if [type] == "performance" { grok { patterns_dir => ["/etc/logstash/patterns"] #match => { "message" => "\[%{HTTPDATE:timestamp}\] \[%{DATA:params1}\] \[%{DATA:params2}\] \[%{DATA:tweet}\]" } match => { "message" => "\[%{HTTPDATE:timestamp}\] \[%{DATA:params1}\]" } } kv { source => "params1" field_split =>"|" } date { match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z","ISO8601"] target => "@timestamp" } mutate { convert => ["Module1", "integer"] convert => ["Module2", "integer"] convert => ["Module3", "integer"] convert => ["Module4", "integer"] convert => ["Module5", "integer"] convert => ["Module6", "integer"] convert => ["Module7", "integer"] convert => ["Module8", "integer"] } mutate { remove_field => ["timestamp","params1"] } } } ``` I am facing the following problems: 1. I am getting only one log entry in Kibana, not all the logs. 2. Modules are not separated. Maybe, something is wrong in filter config file. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 28, 2017, 1:28pm UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/2 "2017-09-28T13:28:21Z")
Here's the interesting part of the error message: > "error"=\>{"type"=\>"version\_conflict\_engine\_exception", "reason"=\>"[log][%{[@metadata][computed\_id]}]: version conflict, document already exists (current version [1]) What does your elasticsearch output plugin configuration look like? ---
**Author:** ![meaniljangra](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Post date:** [September 28, 2017, 1:49pm UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/3 "2017-09-28T13:49:27Z")
Here is the content of 30-elasticsearch-output.conf file: ``` output { elasticsearch { hosts => ["localhost:9200"] document_id => "%{[@metadata][computed_id]}" action => "create" } stdout {codec => rubydebug } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 28, 2017, 2:49pm UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/4 "2017-09-28T14:49:34Z")
Okay. The error message indicates that there is no `[@metadata][computed_id]` field in the events. If you reconfigure your stdout output to `stdout {codec => rubydebug { metadata => true } }` it'll dump the complete event, including the metadata, so you can inspect it. ---
**Author:** ![meaniljangra](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Post date:** [September 29, 2017, 6:26am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/5 "2017-09-29T06:26:40Z")
Hi Magnus, Thanks for finding out the issue. But I have one question. Is computed\_id field default in logstash? Does computed\_id field have default value? Which file does the logstash dump the data to? I know only /var/log/logstash/ directory for logstash logs. I checked the log files but I couldn't get event logs. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 29, 2017, 8:46am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/6 "2017-09-29T08:46:11Z")
> Is computed\_id field default in logstash? No. I assumed you were attempting to create it yourself. > Which file does the logstash dump the data to? It should be in one of the files in /var/log/logstash (if that's where you've configured Logstash to store the logs). ---
**Author:** ![meaniljangra](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Post date:** [October 3, 2017, 11:06am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/7 "2017-10-03T11:06:26Z")
Thanks Magnus. You helped me a lot. My problem related to computed\_id is solved now. But why am I not getting the Modules separated as fields? I am using the kv plugin also. As far as I know my filter config file is proper. Can this issue be because of patterns\_dir as patterns are not there in /etc/logstash/patterns but in /usr/share/some\_path/patterns? I thought this could be the issue but I updated this other path also in patterns\_dir. But still the same issue. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 3, 2017, 11:24am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/8 "2017-10-03T11:24:24Z")
Please show your current configuration and an example of an event (as stored in Elasticsearch) that wasn't processed correctly. ---
**Author:** ![meaniljangra](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@meaniljangra](https://discuss.elastic.co/u/meaniljangra)\ **Post date:** [October 5, 2017, 8:12am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/9 "2017-10-05T08:12:35Z")
Magnus, I found the mistake which was causing the problem in fields separation. Filebeat was sending the document\_type as log while the logstash filter plugin was checking against performance as document\_type. It was my mistake. Thanks for instant help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2017, 8:12am UTC](https://discuss.elastic.co/t/getting-failed-action-error-in-logstash-plain-log/102101/10 "2017-11-02T08:12:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.