# Logstash ConfigurationError - Failed to execute action

**URL:** <https://discuss.elastic.co/t/logstash-configurationerror-failed-to-execute-action/333874>\
**Category:** Logstash\
**Created:** [May 19, 2023, 2:16pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-failed-to-execute-action/333874 "2023-05-19T14:16:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yasser\_Alsawy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yasser_alsawy/32/120976_2.png) [@Yasser\_Alsawy](https://discuss.elastic.co/u/Yasser_Alsawy)\
**Post date:** [May 19, 2023, 2:16pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-failed-to-execute-action/333874/1 "2023-05-19T14:16:28Z")

</div>

I'm getting a configuration error when try to start logstash:

```auto
at line 13, column 28 (byte 213) after 

filter {\n grok {\n match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\n }\n date {\n match => [\"timestamp\" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:392:in `block in converge_state'"]}

```

below is very simple logstash.conf:

```auto
input {
  file {
    path => "/home/yasser/data/access.log"
    start_position => "beginning"
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  date {
    match => ["timestamp" => "dd/MMM/yyyy:HH:mm:ss Z"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  stdout {
    codec => rubydebug
  }
}

```

line 13 is: `match => { "message" => "%{COMBINEDAPACHELOG}" }`  
any syntax error here?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 19, 2023, 2:25pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-failed-to-execute-action/333874/2 "2023-05-19T14:25:51Z")

</div>

> [@Yasser\_Alsawy](#):
>
> ```auto
> date {
> match => ["timestamp" => "dd/MMM/yyyy:HH:mm:ss Z"]
> }
> 
> ```

This is wrong, check the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match).

Should be something like this:

```auto
  date {
    match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2023, 2:26pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-failed-to-execute-action/333874/3 "2023-06-16T14:26:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.