# Pipline aborted on Logstash 2.4 reading pfSense 2.3 logs

**URL:** <https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152>\
**Category:** Logstash\
**Created:** [September 21, 2016, 3:59pm UTC](https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152 "2016-09-21T15:59:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Soren](https://avatars.discourse-cdn.com/v4/letter/s/f14d63/32.png) [@Soren](https://discuss.elastic.co/u/Soren)\
**Post date:** [September 21, 2016, 3:59pm UTC](https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152/1 "2016-09-21T15:59:01Z")

</div>

Hi,

The following code in my 11-pfsense-filter.conf file causes Logstash to fail with a pipeline error:

if [prog] =~ /^filterlog$/ {  
mutate {  
remove\_field =\> ["msg", "datetime"]  
}  
grok {  
patterns\_dir =\> "/etc/logstash/patterns"  
match =\> [ "message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IP\_SPECIFIC\_DATA}%{PFSENSE\_IP\_DATA}%{PFSENSE\_PROTOCOL\_DATA}",  
"message", "%{PFSENSE\_LOG\_DATA}%{PFSENSE\_IPv4\_SPECIFIC\_DATA\_ECN}%{PFSENSE\_IP\_DATA}%{PFSENSE\_PROTOCOL\_DATA}" ]  
}  
mutate {  
lowercase =\> ['proto']  
}  
geoip {  
add\_tag =\> ["GeoIP"]  
source =\> "src\_ip"  
# Optional GeoIP database  
database =\> "/etc/logstash/GeoLiteCity.dat"  
}  
}

This is the error message in the logstash.log file:

{:timestamp=\>"2016-09-21T17:39:34.509000+0200", :message=\>"Pipeline aborted due to error", :exception=\>"Grok::PatternError", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.3/lib/grok-pure.rb:123:in `compile'", "org/jruby/RubyKernel.java:1479:in`loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.3/lib/grok-pure.rb:93:in `compile'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:264:in`register'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:259:in`register'", "org/jruby/RubyHash.java:1342:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:255:in`register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:182:in `start_workers'", "org/jruby/RubyArray.java:1613:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:182:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:136:in`run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:491:in `start\_pipeline'"], :level=\>:error}  
{:timestamp=\>"2016-09-21T17:39:37.522000+0200", :message=\>"stopping pipeline", :id=\>"main"}

Anyone got a suggestion on how to get this working?

Best regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 26, 2016, 7:54pm UTC](https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152/2 "2016-09-26T19:54:20Z")

</div>

The error message suggests that there's a problem with one of your grok patterns.

---

<div class="post-metadata">

**Author:** ![Soren](https://avatars.discourse-cdn.com/v4/letter/s/f14d63/32.png) [@Soren](https://discuss.elastic.co/u/Soren)\
**Post date:** [September 26, 2016, 8:23pm UTC](https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152/3 "2016-09-26T20:23:37Z")

</div>

Yes, I know that now. It was a simple typo in one of my patterns. A clear matter of FFS (Fat Finger Syndrom) as we call it in my family 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/pipline-aborted-on-logstash-2-4-reading-pfsense-2-3-logs/61152/4 "2017-07-06T04:36:46Z")

</div>