# Getting lot of warnings "LogstashJSON - Failed action" in logstash config

**URL:** <https://discuss.elastic.co/t/getting-lot-of-warnings-logstashjson-failed-action-in-logstash-config/87974>\
**Category:** Logstash\
**Created:** [June 1, 2017, 7:29pm UTC](https://discuss.elastic.co/t/getting-lot-of-warnings-logstashjson-failed-action-in-logstash-config/87974 "2017-06-01T19:29:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahul.dhammy](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rahul.dhammy](https://discuss.elastic.co/u/rahul.dhammy)\
**Post date:** [June 1, 2017, 7:29pm UTC](https://discuss.elastic.co/t/getting-lot-of-warnings-logstashjson-failed-action-in-logstash-config/87974/1 "2017-06-01T19:29:31Z")

</div>

Hi  
I am getting lots of warnings in my logstash log. The warning says "LogstashJSON - Failed action"  
I somehow feel this is related to using my multiline codec. I am using logstash to parse my log files and put those in Elastic. I am also not able to find the particular index in elastic which has those multilines. Surprisingly if I change my logstash output to some file, everything works fine. If logstash is writing to elastic server I am facing issues. Any helps would be appreciated.

Below is the sample of my logstash config

input {  
beats {  
port =\> "xxxx"  
codec =\> multiline {  
pattern =\> "^\s\*[0-9]{4}[-][0-9]{1,2}[-][0-9]{1,2}"  
what =\> "previous"  
negate =\> true  
auto\_flush\_interval =\> 1  
}  
}  
}  
filter {  
grok {  
break\_on\_match =\> true  
match =\> ["message", "(?m)%{YEAR:Year}[/-]%{MONTHDAY:Day}[/-]%{MONTHNUM:Month}%{SPACE}%{TIME:logentryTime}%{SPACE}%{DATA:utctime}%{SPACE}[%{DATA:machine}]%{SPACE}[%{INT:threadid}]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}[%{DATA:className}]%{SPACE}[%{DATA:corrid}]%{SPACE}%{GREEDYDATA:logdetails}",  
"message","(?m)%{YEAR:Year}[/-]%{MONTHNUM:Month}[/-]%{MONTHDAY:Day}%{SPACE}%{TIME:logentryTime}%{SPACE}[%{INT:threadid}]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{DATA:className}%{SPACE}[%{DATA:corrid}]%{SPACE}%{GREEDYDATA:logdetails}"]  
}

```
mutate{
          gsub => ["source", "[\\]", "/"]
		  add_field => ["logDateTime", "%{Year}-%{Month}-%{Day} %{logentryTime}"]
		  split => ["source", "/"]
		  add_field => ["ServiceName", "%{[source][2]}" ]
	  }
          
date{
		  match => ["logDateTime" , "yyyy-MM-dd HH:mm:ss,SSS"]
		  target => "@timestamp"
	}
  }

```

output {

```
	elasticsearch_java {
					// server details etc
					}

```

}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2017, 7:29pm UTC](https://discuss.elastic.co/t/getting-lot-of-warnings-logstashjson-failed-action-in-logstash-config/87974/2 "2017-06-29T19:29:43Z")

</div>

Closed on June 29, 2017, 7:29pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.