# \[LogStash::Runner\] agent - failed to fetch pipeline configuration

**URL:** <https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 20, 2018, 10:57pm UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736 "2018-02-20T22:57:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yrizal](https://avatars.discourse-cdn.com/v4/letter/y/b2d939/32.png) [@yrizal](https://discuss.elastic.co/u/yrizal)\
**Post date:** [February 20, 2018, 10:57pm UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736/1 "2018-02-20T22:57:14Z")

</div>

Hi  
I followed the tutorial on "[https://extelligenceblog.it/2017/07/23/elastic-stack-suricata-idps-and-pfsense-firewall-part-3-logstash-pipeline-additions-suricata-alerts/](https://extelligenceblog.it/2017/07/23/elastic-stack-suricata-idps-and-pfsense-firewall-part-3-logstash-pipeline-additions-suricata-alerts/)"

this step is affected error (/usr/share/logstash/bin/logstash -f ./10-pfsense-filter.conf)  
what causes and resolves the error

[ERROR] 2018-02-21 05:47:43.380 [LogStash::Runner] agent - failed to fetch pipeline configuration {:message=\>"No config files found: ./10-pfsense-filter.conf. Can you make sure this path is a logstash config file?"}

ELK Stack 5.6.7, Filebeat 6.2

[Logstash]

```auto
cd /etc/logstash/conf.d
#tcp syslogs stream via 5140
input {
 tcp {
 type => "syslog"
 port => 5140
 }
}
#udp syslogs stream via 5140
input {
 udp {
 type => "syslog"
 port => 5140
 }
}

input {
 beats {
 port => 5044
 }
}

```

sudo nano 10-pfsense-filter.conf

```auto
#input { stdin { } }
filter {
   if [type] =="suricataIDPS" {
      json {
         source => "message"
      }
      date {
         match => ["timestamp", "ISO8601"]
      }
   }
}
#output { stdout { codec => rubydebug } }

```

Filebeat

```auto
filebeat.prospectors: 
  - 
    fields: 
      tags: 
        - SuricataIDPS
        - JSON
      document_type: suricataIDPS
    fields_under_root: true
    type: log
    paths: 
      - /var/log/suricata/*/eve.json*

output.logstash:
  hosts: ["x.x.x.x:5044"]

logging.files: 
  keepfiles: 7
  name: filebeat.log
  path: /var/log/filebeat
logging.to_files: true

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 23, 2018, 4:05pm UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736/2 "2018-02-23T16:05:04Z")

</div>

The tutorial has you write the file to `/etc/logstash/conf.d/10-pfsense-filter.conf`. What directory are you running the command from? You must be in `/etc/logstash/conf.d`.

If you use the absolute path to the config file then you can run the Logstash command from directory. For example:

`/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/10-pfsense-filter.conf`

---

<div class="post-metadata">

**Author:** ![yrizal](https://avatars.discourse-cdn.com/v4/letter/y/b2d939/32.png) [@yrizal](https://discuss.elastic.co/u/yrizal)\
**Post date:** [February 24, 2018, 4:33am UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736/3 "2018-02-24T04:33:33Z")

</div>

thank you sir, i also tried it and it works, but it is empty. finally I try  
`/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/10-pfsense-filter.conf`

`[ERROR] 2018-02-24 11:13:55.726 [[main]<tcp] pipeline - A plugin had an unrecoverable error. Will restart this plug Plugin: <LogStash::Inputs::Tcp type=>"syslog", port=>5140, id=>"de54bfa1d7f7a81e92033d2704be9e04a422f98b-1", enabecs::Line id=>"line_b840a9bd-02ee-46d6-90a3-ca66dc5be4cd", enable_metric=>true, charset=>"UTF-8", delimiter=>"\n">,de=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>> Error: Address already in use`

I look at the log:  
`tail -f logstash-plain.log` success

 ![elk](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6dc59c2315633a74fe5ed820f6ea49c207fe804.JPG)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2018, 4:33am UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736/4 "2018-03-24T04:33:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.