# Logstash with filter wont start: Failed to execute action

**URL:** <https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105>\
**Category:** Logstash\
**Created:** [May 1, 2018, 9:38am UTC](https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105 "2018-05-01T09:38:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sindred](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@sindred](https://discuss.elastic.co/u/sindred)\
**Post date:** [May 1, 2018, 9:38am UTC](https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105/1 "2018-05-01T09:38:07Z")

</div>

**My filter:**

```
input {
  beats {
    port => "5044"
  }
}
filter {
  multiline {
      pattern => "^\s"
      what => "previous"
  }
  dissect {
    mapping => {
      "message" => "%{timestamp} | %{level} | %{subsystem} | %{route} | %{class} | %{message}"
    }
  }
  date {
    match ["timestamp", "ISO8601"]
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[metadata][type]}"
  }
}

```

**Error:**

`Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 17, column 11 (byte 272) after filter {\n multiline {\n pattern => \"^\\s\"\n what => \"previous\"\n }\n dissect {\n mapping => {\n \"message\" => \"%{timestamp} | %{level} | %{subsystem} | %{route} | %{class} | %{message}\"\n }\n }\n date {\n match ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in`block in compile\_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`compile\_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in`block in converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in`block in converge\_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in`converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}`

Example log file: [https://pastebin.com/c5JNw69q](https://pastebin.com/c5JNw69q)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 1, 2018, 9:49am UTC](https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105/2 "2018-05-01T09:49:23Z")

</div>

> [@sindred](#):
>
> multiline {  
> pattern =\> "^\s"  
> what =\> "previous"  
> }

You should not use the multiline filter as this has been deprecated. Best practice is to always perform multiline processing as close to the source as possible. As it looks like you are using Filebeat,[that is where you should be doing it](https://www.elastic.co/guide/en/beats/filebeat/6.2/multiline-examples.html).

> [@sindred](#):
>
> date {  
> match ["timestamp", "ISO8601"]  
> }

The error message is however due to the fact that the date filter is not correct as you are missing `=>`.

---

<div class="post-metadata">

**Author:** ![sindred](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@sindred](https://discuss.elastic.co/u/sindred)\
**Post date:** [May 1, 2018, 2:26pm UTC](https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105/3 "2018-05-01T14:26:49Z")

</div>

Super, thank you!

How should my split line look like ?  
This did not work as i wanted it to:

```
  ### Multiline options
  multiline.pattern: ^\s
  multiline.negate: true
  multiline.match: after

```

Example log: [https://pastebin.com/NnThSGd7](https://pastebin.com/NnThSGd7)

The messages always is formatted like this:  
%{timestamp} | %{level} | %{subsystem} | %{route} | %{class} | %{message}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2018, 2:26pm UTC](https://discuss.elastic.co/t/logstash-with-filter-wont-start-failed-to-execute-action/130105/4 "2018-05-29T14:26:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.