# Logstash Error Failed to Execute action **URL:** \ **Category:** Logstash\ **Created:** [September 23, 2022, 7:13pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051 "2022-09-23T19:13:15Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Technolust](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Post date:** [September 23, 2022, 7:13pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/1 "2022-09-23T19:13:15Z")
Team, I've lost all my hair... For whatever reason, I can't figure this out. [2022-09-23T15:09:46,265][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:210:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:909:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:381:in `block in converge\_state'"]} [2022-09-23T15:09:46,348][INFO][logstash.runner] Logstash shut down. [2022-09-23T15:09:46,356][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~[jruby.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:753) ~[jruby.jar:?] at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:91) ~[?:?] Here is a copy of my logstash.conf... ```auto input { tcp { host => "10.141.0.172" port => 5045 } } # filter { if [type] == "syslog" { grok { match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } date { match => ["received_from", "%{host}"] } } } output { elasticsearch { hosts => ["https://10.141.0.170:9200"] } } ``` Any help growing my hair back would be beneficial!!! ---
**Author:** ![Technolust](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Post date:** [September 23, 2022, 7:16pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/2 "2022-09-23T19:16:25Z")
Also if I add the if syslog or remove the if syslog still the same error. However, I did remove the if syslog since I don't have a type =\> syslog statement. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 23, 2022, 7:22pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/3 "2022-09-23T19:22:25Z")
Are you setting path.config (either in logstash.yml, pipelines.yml, or on the command line using -f). If so, what value are you setting? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 23, 2022, 7:22pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/4 "2022-09-23T19:22:53Z")
> [@Technolust](#): > > `# filter` Is this a typo or the `filter {` is commented? Also, the error is here: > [@Technolust](#): > > Expected one of [\t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1) You need to check if your config is correct. You need a `input` block, `filter` block and `output` block. Validate your config and if all the block have the correct opening `{`and closing `}`, the configuration you shared is wrong because you are not opening the `filter` block, it is commented. ---
**Author:** ![Technolust](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Post date:** [September 23, 2022, 7:58pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/7 "2022-09-23T19:58:07Z")
```auto input { tcp { host => "10.141.0.172" port => 5045 } } filter { grok { match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } date { match => ["received_from", "%{host}"] } } output { elasticsearch { hosts => ["https://10.141.0.170:9200"] } stdout { } } ~ ``` ---
**Author:** ![Technolust](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Post date:** [September 23, 2022, 8:00pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/8 "2022-09-23T20:00:57Z")
Pipelines: - pipeline.id: main path.config: "/etc/logstash/conf.d/\*.conf" syslog.conf is located in /etc/logstash/conf.d/ Logstash.yml Data Path: path.data: /var/lib/logstash # log.level: info path.logs: /var/log/logstash ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 23, 2022, 8:14pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/9 "2022-09-23T20:14:12Z")
> [@Technolust](#): > > path.config: "/etc/logstash/conf.d/\*.conf" I suspect that path.config is picking up another file and that the unwanted file does not look like a logstash configuration. Try changing that to specify the single file you want. ---
**Author:** ![Technolust](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Post date:** [September 23, 2022, 9:38pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/10 "2022-09-23T21:38:01Z")
Ok so there were two things. I did have to specify the .conf file in the path.config. However, I also had to specify the cert and user creds in the conf file for the elasticsearch output. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 21, 2022, 9:38pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-execute-action/315051/11 "2022-10-21T21:38:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.