# Pipeline aborted due to error.PatternError: pattern %{REMOTEIP:remoteip} not defined\>

**URL:** <https://discuss.elastic.co/t/pipeline-aborted-due-to-error-patternerror-pattern-remoteip-remoteip-not-defined/200677>\
**Category:** Logstash\
**Created:** [September 23, 2019, 11:08am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-patternerror-pattern-remoteip-remoteip-not-defined/200677 "2019-09-23T11:08:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deepanshu\_Malik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepanshu_malik/32/54724_2.png) [@Deepanshu\_Malik](https://discuss.elastic.co/u/Deepanshu_Malik)\
**Post date:** [September 23, 2019, 11:08am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-patternerror-pattern-remoteip-remoteip-not-defined/200677/1 "2019-09-23T11:08:47Z")

</div>

here is my config file

input {  
file {  
path =\> "/log/apache-log/access\_log"  
type =\> "accesslogs"  
}  
}

filter {  
if [type] == "accesslogs" {  
grok {  
patterns\_dir =\> "/opt/elastic/logstash/patterns/"  
match =\> { "message" =\> "'%{REMOTEIP:remoteip}'?%{IGNORE:ignore}? +%{IP:cdnip} %{USER:logname} %{USER:username} [%{HTTPDATE:timestamp}] "%{WORD:method} %{DATA:url} HTTP/%{NUMBER:version}" %{NUMBER:status} %{SIZE:size} "%{DATA:referer}" "%{DATA:useragent}" %{NOTSPACE:session} %{NOTSPACE:domain} %{NUMBER:seconds}/%{NUMBER:microsecs}" }  
remove\_field =\> ["logname","username","version","@version","message","path","ignore"]  
}  
date {  
match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]  
remove\_field =\> ["timestamp"]  
}  
grok {  
match =\> { "url" =\> "%{URIPATH:api}??%{GREEDYDATA:payload}?" }  
remove\_field =\> ["url"]  
}  
kv {  
source =\> "payload"  
allow\_duplicate\_values =\> false  
field\_split =\> "&?"  
include\_keys =\> ["aid", "h","ct"]  
}  
urldecode {  
all\_fields=\>true  
charset=\>"UTF-8"  
}  
#supported in logstash version 6+  
kv {  
source =\> "iBeatField"  
allow\_duplicate\_values =\> false  
field\_split\_pattern =\> "\-\-"  
remove\_field =\> ["undefined","undefined HTTP/1.1"]  
}  
if [size] == "-" {  
mutate {  
replace =\> ["size", "0"]  
}  
}  
if [ct] == "undefined" {  
mutate {  
replace =\> ["ct", "-1"]  
}  
}  
}  
}

output {  
stdout {}  
}

and here's the error

[2019-09-23T15:24:59,701][ERROR][logstash.javapipeline] Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\<Grok::PatternError: pattern %{REMOTEIP:remoteip} not defined\>, :backtrace=\>["/opt/elastic/logstash-7.3.2/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1425:in`loop'", "/opt/elastic/logstash-7.3.2/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in `compile'", "/opt/elastic/logstash-7.3.2/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.1.1/lib/logstash/filters/grok.rb:274:in`block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/opt/elastic/logstash-7.3.2/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.1.1/lib/logstash/filters/grok.rb:268:in`block in register'", "org/jruby/RubyHash.java:1419:in `each'", "/opt/elastic/logstash-7.3.2/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.1.1/lib/logstash/filters/grok.rb:263:in`register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:in `register'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java_pipeline.rb:192:in`block in register\_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java_pipeline.rb:191:in`register\_plugins'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java\_pipeline.rb:463:in `maybe_setup_out_plugins'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java_pipeline.rb:204:in`start\_workers'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java\_pipeline.rb:146:in `run'", "/opt/elastic/logstash-7.3.2/logstash-core/lib/logstash/java_pipeline.rb:105:in`block in start'"], :thread=\>"#\<Thread:0x52fe5074 run\>"}  
[2019-09-23T15:24:59,709][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}

please help asap

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2019, 11:08am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-patternerror-pattern-remoteip-remoteip-not-defined/200677/2 "2019-10-21T11:08:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.