# Logstash won't start pipeline after moving to 7.6.13 from 6.5.x

**URL:** <https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035>\
**Category:** Logstash\
**Created:** [February 23, 2022, 12:56pm UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035 "2022-02-23T12:56:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [February 23, 2022, 12:56pm UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035/1 "2022-02-23T12:56:23Z")

</div>

Hi All, I've gotten a problem with my old logstash pipeline.

My config looks like this (everything is commented out during debugging):

```auto
[root@ALPHA00035 pipeline]# cat logstash.conf
input {
        beats {
                port => 5000
                ecs_compatibility => disabled
        }
        syslog {
        }
}

#############################################
# Interpret Portrait ERRORS log #
#############################################

#filter {
# if "portraiterrors" in [fields][logtype] {
# kv {
# source => "message"
# value_split => ":"
# field_split => "\n"
# include_keys => ["Time", "Username", "Instance name", "Instancename", "Exception", "Exception type", "ErrorCode", "Module", "Procedure", "Version", "Memory usage"]
# }
# if ![Instance name] {
# mutate {
# rename => { "Instancename" => "Instance name" }
# }
# }
# date {
# match => ["Time", "MM/dd/yyyy HH:mm:ss aa", "M/d/yyyy HH:mm:ss aa", "M/d/yyyy H:m:ss aa", "dd-MM-yyyy HH:mm:ss", "d-M-yyyy HH:mm:ss", "MM/dd/yyyy", "M/d/yyyy", "dd-MM-yyyy", "d-M-yyyy"]
# timezone => "Europe/Copenhagen"
# }
# }
#}

#############################################

#############################################
# Output to Elastic Search #
# Index name is defined by logtype #
#############################################

output {
  elasticsearch {
    hosts => "https://elasticsearch:9200"
      index => "%{[[fields][logtype]}-%{[@metadata][version]}-%{+YYYY.MM}"
      document_type => "%{[@metadata][type]}"
      cacert => "/usr/share/logstash/config/certs/ca/ca.crt"
      user => logstash_internal
      password => <PW>
  }
}

```

But when I start logstash

```auto
logstash | [2022-02-23T12:44:47,086][ERROR][logstash.javapipeline][main] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"main", :error=>"Invalid FieldReference: `[[fields][logtype]`"

```

So what am I doing wrong now?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 23, 2022, 2:39pm UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035/2 "2022-02-23T14:39:28Z")

</div>

> [@fribse](#):
>
> `index => "%{[[fields][logtype]}...`

Remove one of the two [ at the start of that reference.

---

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [February 24, 2022, 6:45am UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035/3 "2022-02-24T06:45:09Z")

</div>

Ok, that's interesting, that error must've been there for ages, and I never noticed it and it worked with the old version 🙂  
Thankyou very much @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2022, 6:45am UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035/4 "2022-03-24T06:45:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.