# Logstash input elasticsearch argument error

**URL:** https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538
**Category:** Logstash
**Created:** [December 6, 2022, 7:59am UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538 "2022-12-06T07:59:32Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![CherryGoose](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cherrygoose/32/104911_2.png) [@CherryGoose](https://discuss.elastic.co/u/CherryGoose)
#### Post date: [December 6, 2022, 7:59am UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538/1 "2022-12-06T07:59:32Z")

</div>

Hello. Im trying to setup my logstash to take docs from elastic and output them to console and im getting the following error

[ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil\n(secs:1670312766.191,utc~:"2022-12-06 07:46:06.19099998474121094",ltz~:nil)\n(etz:nil,tnz:"ALMT",tziv:"2.0.5",tzidv:"1.2022.6",rv:"2.6.8",rp:"java",win:true,rorv:nil,astz:nil,eov:"1.2.7",eotnz:"???",eotnfz:"???",eotlzn:"???",\ndebian:nil,centos:nil,osx:nil)\nTry setting `ENV['TZ'] = 'Continent/City'` in your script (see [List of tz database time zones - Wikipedia](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones))", :backtrace=\>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:120)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:85)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:846)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1229)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1202)", "org.jruby.ir.targets.indy.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:29)", "C\_3a\_.C\_23\_\_Projects.ELASTICSEARCH.logstash\_minus\_8\_dot\_5\_dot\_1\_minus\_windows\_minus\_x86\_64.logstash\_minus\_8\_dot\_5\_dot\_1.logstash\_minus\_core.lib.logstash.java\_pipeline.RUBY$method$initialize$0(C:/C#_Projects/ELASTICSEARCH/logstash-8.5.1-windows-x86\_64/logstash-8.5.1/logstash-core/lib/logstash/java\_pipeline.rb:48)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:139)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:112)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:329)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:911)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.ir.targets.indy.InvokeSite.invoke(InvokeSite.java:208)", "C\_3a_.C\_23\_\_Projects.ELASTICSEARCH.logstash\_minus\_8\_dot\_5\_dot\_1\_minus\_windows\_minus\_x86\_64.logstash\_minus\_8\_dot\_5\_dot\_1.logstash\_minus\_core.lib.logstash.pipeline\_action.create.RUBY$method$execute$0(C:/C#_Projects/ELASTICSEARCH/logstash-8.5.1-windows-x86\_64/logstash-8.5.1/logstash-core/lib/logstash/pipeline\_action/create.rb:50)", "C\_3a_.C\_23\_\_Projects.ELASTICSEARCH.logstash\_minus\_8\_dot\_5\_dot\_1\_minus\_windows\_minus\_x86\_64.logstash\_minus\_8\_dot\_5\_dot\_1.logstash\_minus\_core.lib.logstash.pipeline\_action.create.RUBY$method$execute$0$ **VARARGS** (C:/C#_Projects/ELASTICSEARCH/logstash-8.5.1-windows-x86\_64/logstash-8.5.1/logstash-core/lib/logstash/pipeline\_action/create.rb:49)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:139)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:112)", "org.jruby.ir.targets.indy.InvokeSite.invoke(InvokeSite.java:208)", "C\_3a_.C\_23\_\_Projects.ELASTICSEARCH.logstash\_minus\_8\_dot\_5\_dot\_1\_minus\_windows\_minus\_x86\_64.logstash\_minus\_8\_dot\_5\_dot\_1.logstash\_minus\_core.lib.logstash.agent.RUBY$block$converge\_state$2(C:/C#_Projects/ELASTICSEARCH/logstash-8.5.1-windows-x86\_64/logstash-8.5.1/logstash-core/lib/logstash/agent.rb:386)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:141)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:64)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:143)", "org.jruby.RubyProc.call(RubyProc.java:309)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:107)", "java.base/java.lang.Thread.run(Thread.java:833)"]}  
[2022-12-06T13:46:09,776][INFO][logstash.runner] Logstash shut down.  
[2022-12-06T13:46:09,781][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit  
org.jruby.exceptions.SystemExit: (SystemExit) exit  
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~[jruby.jar:?]  
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:753) ~[jruby.jar:?]  
at C\_3a_.C\_23\_\_Projects.ELASTICSEARCH.logstash\_minus\_8\_dot\_5\_dot\_1\_minus\_windows\_minus\_x86\_64.logstash\_minus\_8\_dot\_5\_dot\_1.lib.bootstrap.environment.(C:\C#\_Projects\ELASTICSEARCH\logstash-8.5.1-windows-x86\_64\logstash-8.5.1\lib\bootstrap\environment.rb:91) ~[?:?]

My config looks like this

input {  
elasticsearch {  
hosts =\> "localhost"  
query =\> '{ "query": { "match": { "statuscode": 200 } }, "sort": ["\_doc"] }'  
}  
}  
output  
{  
stdout {}  
}

can someone tell me what's the problem and how to fix it?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2023, 8:00am UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-argument-error/320538/2 "2023-01-03T08:00:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
