# Logstash Pipline aborted error

**URL:** <https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946>\
**Category:** Logstash\
**Created:** [February 4, 2017, 1:57pm UTC](https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946 "2017-02-04T13:57:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mliu1212](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@mliu1212](https://discuss.elastic.co/u/mliu1212)\
**Post date:** [February 4, 2017, 1:57pm UTC](https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946/1 "2017-02-04T13:57:18Z")

</div>

I am trying to run Suricata with the ELK stack - I cannot get my info to visualize on Kibana bc the Logstash pipline keeps breaking down:

```
{:timestamp=>"2017-02-04T13:50:29.731000+0000", :message=>"Pipeline aborted due to error", :exception=>"ArgumentError", :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-2.2.5/lib/logstash/inputs/file.rb:221:in `register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:330:in `start_inputs'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:329:in `start_inputs'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:180:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:491:in `start_pipeline'"], :level=>:error}
{:timestamp=>"2017-02-04T13:50:32.735000+0000", :message=>"stopping pipeline", :id=>"main"}

```

Here is my config file:

input {  
file {  
path =\> ["/var/log/suricata/eve.json"]  
sincedb\_path =\> ["/var/lib/logstash/"]  
codec =\> "json"  
type =\> "SuricataIDPS"  
}

}

filter {  
if [type] == "SuricataIDPS" {  
date {  
match =\> ["timestamp", "ISO8601"]  
}  
ruby {  
code =\> "if event['event\_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to\_s.split(',')[0]; end;"  
}  
}

if [src\_ip] {  
geoip {  
source =\> "src\_ip"  
target =\> "geoip"  
#database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float" ]  
}  
if ![geoip.ip] {  
if [dest\_ip] {  
geoip {  
source =\> "dest\_ip"  
target =\> "geoip"  
#database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float" ]  
}  
}  
}  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost"  
#protocol =\> http  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 5, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946/2 "2017-02-05T09:36:06Z")

</div>

Sincedb is a string, not an array. I'd start by fixing that.

> [@mliu1212](#):
>
> target =\> "geoip" #database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat" add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]

Not needed, it does that itself.[quote="mliu1212, post:1, topic:73946"]  
mutate { convert =\> ["[geoip][coordinates]", "float" ] }  
[/quote]

Again, not needed.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2017, 7:14am UTC](https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946/3 "2017-02-06T07:14:40Z")

</div>

Apart from what Mark said, `sincedb_path` needs to be the path to a file and not a directory.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2017, 7:14am UTC](https://discuss.elastic.co/t/logstash-pipline-aborted-error/73946/4 "2017-03-06T07:14:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.