# Logstash agent stopped due to error "Don't know how to handle \`Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\\`" **URL:** \ **Category:** Logstash\ **Created:** [March 9, 2022, 5:11am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168 "2022-03-09T05:11:09Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ashiqab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashiqab/32/103144_2.png) [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Post date:** [March 9, 2022, 5:11am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168/1 "2022-03-09T05:11:09Z")
Hi, I am new to ELK stack and have installed the three components on my SUSE linux 12 server. Running java 17.0.2. My logstash-plain.log repeats the java error for the agent which stops with below error: [2022-03-09T06:03:08,380][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties [2022-03-09T06:03:08,392][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"8.0.1", "jruby.version"=\>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86\_64]"} [2022-03-09T06:03:08,395][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2022-03-09T06:03:10,020][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600, :ssl\_enabled=\>false} [2022-03-09T06:03:11,524][INFO][org.reflections.Reflections] Reflections took 111 ms to scan 1 urls, producing 120 keys and 417 values [2022-03-09T06:03:12,600][ERROR][logstash.outputs.Elasticsearch] Invalid setting for Elasticsearch output plugin: output { Elasticsearch { # This setting must be a path # File does not exist or cannot be opened /etc/Elasticsearch/certs/http\_ca.crt cacert =\> "/etc/Elasticsearch/certs/http\_ca.crt" ... } } [2022-03-09T06:03:12,620][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=\>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:120)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:85)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)", "org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:47)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:333)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.pipeline\_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:50)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.pipeline\_action.create.RUBY$method$execute$0$ **VARARGS** (/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:49)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.agent.RUBY$block$converge\_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:376)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.base/java.lang.Thread.run(Thread.java:829)"]} [2022-03-09T06:03:12,635][ERROR][logstash.agent] An exception happened when converging configuration {:exception=\>LogStash::Error, :message=\>"Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create
`"} [2022-03-09T06:03:12,654][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\`\>, :backtrace=\>["org/logstash/execution/ConvergeResultExt.java:135:in `create'", "org/logstash/execution/ConvergeResultExt.java:60:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:389:in `block in converge\_state'"]} [2022-03-09T06:03:12,662][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?] at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?] My configuration file is as below: input { file { path =\> "/path/to/data/accessinfologs" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { separator =\> "," columns =\> ["timestamp","script","emp\_id","server"] } } output { Elasticsearch { hosts =\> "[http://localhost:9200](http://localhost:9200)" index =\> "accessinfolog" cacert =\> '/etc/Elasticsearch/certs/http\_ca.crt' user =\> elastic password =\> passwrd } stdout {} } Could you please help in diagnosing the error? Any inputs would be much appreciated as I am performing a POC on ELK stack set up for our custom script logs. Thanks and regards, Ashiq ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 9, 2022, 5:41am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168/2 "2022-03-09T05:41:41Z")
> [@ashiqab](#): > > ```auto > Elasticsearch { > # This setting must be a path > # File does not exist or cannot be opened /etc/Elasticsearch/certs/http_ca.crt > cacert => "/etc/Elasticsearch/certs/http_ca.crt" > ... > } > > ``` You should focus on the existence of this file and the permissions on the directories that contain it. ---
**Author:** ![ashiqab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashiqab/32/103144_2.png) [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Post date:** [March 9, 2022, 6:43am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168/3 "2022-03-09T06:43:41Z")
Thank you so much for the response. I fixed the path access issue. However I am getting connection refused error from Elasticsearch localhost: vlcdbdd2:/usr/share/logstash/bin # ./logstash -f /etc/logstash/conf.d/accessinfologs.conf Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2022-03-09 07:29:01.154 [main] runner - The use of JAVA\_HOME has been deprecated. Logstash 8.0 and later ignores JAVA\_HOME and uses the bundled JDK. Running Logstash with the bundled JDK is recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK (organizational-specific compliance requirements, for example), you can configure LS\_JAVA\_HOME to use that version instead. [INFO] 2022-03-09 07:29:01.159 [main] runner - Starting Logstash {"logstash.version"=\>"8.0.1", "jruby.version"=\>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86\_64]"} [INFO] 2022-03-09 07:29:01.161 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [WARN] 2022-03-09 07:29:01.509 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2022-03-09 07:29:03.475 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9601, :ssl\_enabled=\>false} [INFO] 2022-03-09 07:29:04.385 [Converge PipelineAction::Create] Reflections - Reflections took 105 ms to scan 1 urls, producing 120 keys and 417 values [INFO] 2022-03-09 07:29:05.813 [Converge PipelineAction::Create] javapipeline - Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise. [INFO] 2022-03-09 07:29:05.866 [[main]-pipeline-manager] Elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[http://localhost:9200](http://localhost:9200)"]} [INFO] 2022-03-09 07:29:06.277 [[main]-pipeline-manager] Elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://localhost:9200/](http://localhost:9200/)]}} [INFO] 2022-03-09 07:29:06.429 [[main]-pipeline-manager] Elasticsearch - Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>org.apache.http.NoHttpResponseException: localhost:9200 failed to respond} [WARN] 2022-03-09 07:29:06.433 [[main]-pipeline-manager] Elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"} [INFO] 2022-03-09 07:29:06.483 [[main]-pipeline-manager] Elasticsearch - Config is not compliant with data streams. `data_stream => auto` resolved to `false` [WARN] 2022-03-09 07:29:06.485 [[main]-pipeline-manager] Elasticsearch - Elasticsearch Output configured with `ecs_compatibility => v8`, which resolved to an UNRELEASED preview of version 8.0.0 of the Elastic Common Schema. Once ECS v8 and an updated release of this plugin are publicly available, you will need to update this plugin to resolve this warning. [INFO] 2022-03-09 07:29:06.500 [[main]-pipeline-manager] csv - ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are likely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this message) [INFO] 2022-03-09 07:29:06.561 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>250, "pipeline.sources"=\>["/etc/logstash/conf.d/accessinfologs.conf"], :thread=\>"#\"} [INFO] 2022-03-09 07:29:07.643 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=\>1.08} [INFO] 2022-03-09 07:29:07.700 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"} [INFO] 2022-03-09 07:29:07.761 [[main]\1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [INFO] 2022-03-09 07:29:11.508 [Ruby-0-Thread-9: :1] Elasticsearch - Failed to perform request {:message=\>"localhost:9200 failed to respond", :exception=\>Manticore::ClientProtocolException, :cause=\>org.apache.http.NoHttpResponseException: localhost:9200 failed to respond} [WARN] 2022-03-09 07:29:11.509 [Ruby-0-Thread-9: :1] Elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"[http://localhost:9200/](http://localhost:9200/)", :exception=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=\>"Elasticsearch Unreachable: [[http://localhost:9200/](http://localhost:9200/)][Manticore::ClientProtocolException] localhost:9200 failed to respond"} This error repeats when i remove the cacert entry in the config file. Could you please guide me? Thanks and regards, Ashiq ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2022, 6:44am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168/4 "2022-04-06T06:44:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.