# Logstash Configuration Error -\*\*Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 14
**URL:** https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717
**Category:** Logstash
**Created:** [June 13, 2018, 12:31pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717 "2018-06-13T12:31:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@priya1](https://discuss.elastic.co/u/priya1)
#### Post date: [June 13, 2018, 12:31pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717/1 "2018-06-13T12:31:19Z")
Hi Team,
Please find the details below,
Code : input{
file {
path =\> "C:\Users\priya\_shukla\Desktop\SAPLogsERR\test2.log"
start\_position =\> "beginning"
sincedb\_path =\> "C:\Users\priya\_shukla\Downloads\logstash-6.2.4\logstash-6.2.4\logs\sincedb"
}
}
filter {
grok
{
match =\> ["message", "%{DATA:date} %{DATA:timestamp}"]
}
mutate {
add\_field =\> { "sap\_process\_time" ,"%{date} %{timestamp}" }
}
}
output{
csv{
fields =\> ["sap\_process\_time"]
path =\> "C:\Users\priya\_shukla\Downloads\logstash-6.2.4\logstash-6.2.4\demo.csv"
}
}
Error :
[2018-06-13T17:57:18,047][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/modules/fb\_apache/configuration"}
[2018-06-13T17:57:18,071][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/modules/netflow/configuration"}
[2018-06-13T17:57:18,339][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-06-13T17:57:19,231][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.2.4"}
[2018-06-13T17:57:20,219][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
[2018-06-13T17:57:21,019][ERROR][logstash.agent] **Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 14,** column 44 (byte 347) after filter {\ngrok \n{\nmatch =\> ["message", "%{DATA:date}\t%{DATA:timestamp}"]\n}\n\tmutate {\n\t add\_field =\> { "sap\_process\_time" ", :backtrace=\>["C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:90:in `execute'", "C:/Users/priya_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "C:/Users/priya\_shukla/Downloads/logstash-6.2.4/logstash-6.2.4/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
Kindly guide the solution or identify where the mistake is there .
Priya
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2018, 12:49pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717/2 "2018-06-13T12:49:00Z")
> [@priya1](#):
>
> add\_field =\> { "sap\_process\_time" ,"%{date} %{timestamp}" }
Should be
```
add_field => { "sap_process_time" => "%{date} %{timestamp}" }
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 13, 2018, 1:39pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717/3 "2018-06-13T13:39:51Z")
> grok
> {
> match =\> ["message", "%{DATA:date} %{DATA:timestamp}"]
> }
> mutate {
> add\_field =\> { "sap\_process\_time" ,"%{date} %{timestamp}" }
> }
What are you trying to do there? You're taking a string apart and putting it back together again.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2018, 1:39pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-at-line-14/135717/4 "2018-07-11T13:39:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.