# Problems with Logstash Pipeline to ElasticSearch **URL:** \ **Category:** Logstash\ **Created:** [December 3, 2021, 10:46pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936 "2021-12-03T22:46:39Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 3, 2021, 10:46pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/1 "2021-12-03T22:46:39Z")
Hi i have some erros to up my logstash service as bellows ```auto [2021-12-03T19:44:46,535][INFO][logstash.javapipeline][KSC] Pipeline terminated {"pipeline.id"=>"KSC"} [2021-12-03T19:44:46,550][ERROR][logstash.agent] Failed to execute action {:id=>:Forti_IPS, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil} [2021-12-03T19:44:46,551][ERROR][logstash.agent] Failed to execute action {:id=>:KSC, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil} [2021-12-03T19:44:46,799][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2021-12-03T19:44:51,692][INFO][logstash.runner] Logstash shut down. [2021-12-03T19:44:51,767][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ``` ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 3, 2021, 10:51pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/2 "2021-12-03T22:51:00Z")
pipelines.yml ```auto # cat pipelines.yml # This file is where you define your pipelines. You can define multiple. # For more information on multiple pipelines, see the documentation: # https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html - pipeline.id: Forti_IPS path.config: "/etc/logstash/conf.d/forti_IPS.conf" - pipeline.id: KSC path.config: "/etc/logstash/conf.d/ksc.conf" ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 3, 2021, 11:15pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/3 "2021-12-03T23:15:24Z")
If you enable log.level debug do you get any more informative messages? ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 3, 2021, 11:21pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/4 "2021-12-03T23:21:15Z")
Follows ```auto [2021-12-03T20:20:29,000][INFO][logstash.javapipeline][Forti_IPS] Pipeline terminated {"pipeline.id"=>"Forti_IPS"} [2021-12-03T20:20:29,023][ERROR][logstash.agent] Failed to execute action {:id=>:Forti_IPS, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil} [2021-12-03T20:20:29,062][DEBUG][logstash.agent] Starting puma [2021-12-03T20:20:29,088][DEBUG][logstash.instrument.periodicpoller.os] Stopping [2021-12-03T20:20:29,089][DEBUG][logstash.agent] Trying to start WebServer {:port=>9600} [2021-12-03T20:20:29,112][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping [2021-12-03T20:20:29,116][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping [2021-12-03T20:20:29,120][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Stopping [2021-12-03T20:20:29,129][DEBUG][logstash.api.service] [api-service] start [2021-12-03T20:20:29,132][DEBUG][logstash.agent] Shutting down all pipelines {:pipelines_count=>0} [2021-12-03T20:20:29,142][DEBUG][logstash.agent] Converging pipelines state {:actions_count=>0} [2021-12-03T20:20:29,278][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2021-12-03T20:20:34,363][INFO][logstash.runner] Logstash shut down. [2021-12-03T20:20:34,389][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [December 3, 2021, 11:27pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/5 "2021-12-03T23:27:37Z")
Can you add few lines before [2021-12-03T20:20:29,000][INFO][logstash.javapipeline][Forti\_IPS] Pipeline ... ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 4, 2021, 3:29am UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/6 "2021-12-04T03:29:13Z")
You need to share your pipelines configuration as well to help understand why logstash can't start them. ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 4, 2021, 1:00pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/7 "2021-12-04T13:00:35Z")
I`m already share, if you see in the earlier posts. ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 4, 2021, 1:09pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/8 "2021-12-04T13:09:06Z")
````auto filter_to_output -> P[output-stdout{"codec"=>"rubydebug"}|[file]/etc/logstash/conf.d/forti_IPS.conf:46:1:``` stdout { codec => rubydebug } ```] **GRAPH** [2021-12-04T10:07:36,916][DEBUG][logstash.javapipeline] Starting pipeline {:pipeline_id=>"Forti_IPS"} [2021-12-04T10:07:36,973][DEBUG][logstash.outputs.elasticsearch][Forti_IPS] Normalizing http path {:path=>nil, :normalized=>nil} [2021-12-04T10:07:37,000][WARN][logstash.outputs.elasticsearch][Forti_IPS] **WARNING** Detected UNSAFE options in elasticsearch output configuration! **WARNING** You have enabled encryption but DISABLED certificate verification. **WARNING** To make sure your data is secure change :ssl_certificate_verification to true [2021-12-04T10:07:37,428][INFO][logstash.outputs.elasticsearch][Forti_IPS] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash_scbraganca:xxxxxx@glb-elkdat-01:9200/]}} [2021-12-04T10:07:37,477][DEBUG][logstash.outputs.elasticsearch][Forti_IPS] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://logstash_scbraganca:xxxxxx@glb-elkdat-01:9200/, :path=>"/"} [2021-12-04T10:07:37,907][DEBUG][logstash.outputs.stdout][Forti_IPS] Closing {:plugin=>"LogStash::Outputs::Stdout"} [2021-12-04T10:07:37,917][DEBUG][logstash.pluginmetadata][Forti_IPS] Removing metadata for plugin 39b3c9a14b210b713f4418afb2053ce3066e93d41d03732550f8c92080515d19 [2021-12-04T10:07:37,923][ERROR][logstash.javapipeline][Forti_IPS] Pipeline error {:pipeline_id=>"Forti_IPS", :exception=>#, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:74:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:332:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:261:in `health_check_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:270:in `block in healthcheck!'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:266:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:382:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:82:in `update_initial_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:76:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:302:in `build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:64:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:105:in `create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:101:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch.rb:307:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.7.3-java/lib/logstash/outputs/elasticsearch/common.rb:23:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:585:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/forti_IPS.conf"], :thread=>"#"} [2021-12-04T10:07:37,930][INFO][logstash.javapipeline][Forti_IPS] Pipeline terminated {"pipeline.id"=>"Forti_IPS"} [2021-12-04T10:07:37,950][ERROR][logstash.agent] Failed to execute action {:id=>:Forti_IPS, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil} [2021-12-04T10:07:37,999][DEBUG][logstash.instrument.periodicpoller.os] Stopping [2021-12-04T10:07:38,007][DEBUG][logstash.agent] Starting puma [2021-12-04T10:07:38,021][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping [2021-12-04T10:07:38,035][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping [2021-12-04T10:07:38,037][DEBUG][logstash.instrument.periodicpoller.deadletterqueue] Stopping [2021-12-04T10:07:38,039][DEBUG][logstash.agent] Trying to start WebServer {:port=>9600} [2021-12-04T10:07:38,055][DEBUG][logstash.agent] Shutting down all pipelines {:pipelines_count=>0} [2021-12-04T10:07:38,061][DEBUG][logstash.agent] Converging pipelines state {:actions_count=>0} [2021-12-04T10:07:38,096][DEBUG][logstash.api.service] [api-service] start [2021-12-04T10:07:38,227][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2021-12-04T10:07:43,101][INFO][logstash.runner] Logstash shut down. [2021-12-04T10:07:43,155][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit [2021-12-04T10:07:43,164][DEBUG][logstash.agent] 2021-12-04 10:07:43 -0300: Listen loop error: # org/jruby/RubyIO.java:3067:in `read' org/jruby/RubyIO.java:3049:in `read' /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/puma-4.3.7-java/lib/puma/server.rb:440:in `handle_check' /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/puma-4.3.7-java/lib/puma/server.rb:386:in `block in handle_servers' org/jruby/RubyArray.java:1809:in `each' /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/puma-4.3.7-java/lib/puma/server.rb:384:in `handle_servers' /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/puma-4.3.7-java/lib/puma/server.rb:356:in `block in run' ```` ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 4, 2021, 1:13pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/9 "2021-12-04T13:13:23Z")
> [@leandrojmp](#): > > You need to share your pipelines configuration as well to help understand why logstash can't start them. ```auto # This file is where you define your pipelines. You can define multiple. # For more information on multiple pipelines, see the documentation: # https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html - pipeline.id: Fortigate_IPS path.config: "/etc/logstash/conf.d/forti_IPS.conf" - pipeline.id: KSC path.config: "/etc/logstash/conf.d/ksc.conf" ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/10 "2021-12-04T14:42:25Z")
> :exception=\>#\ The JVM failed to read the trust store. This [SO Q&A](https://stackoverflow.com/questions/6784463/error-trustanchors-parameter-must-be-non-empty) has some pointers. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 4, 2021, 2:56pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/11 "2021-12-04T14:56:28Z")
This is your `pipelines.yml`, the pipelines configuration are the content of the `.conf` files. It would help to know what is the content of the `forti_IPS.conf` and `ksc.conf`, maybe there is something wrong in the configuration that can give a hint of why logstash cannot start. ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 10, 2021, 7:45pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/12 "2021-12-10T19:45:02Z")
Hello, After some time, I reinstall the whole enviroment (linux, logstash package, conf files), and put a configuration files of other logstash that's already running fine! I see, if I change my logstash output certificate to connect in my elasticsearch cluster, appears the error bellow ```auto [2021-12-10T16:37:25,267][WARN][logstash.outputs.elasticsearch][KSC] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_fccsa:xxxxxx@glb-elkdat-01:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_fccsa:xxxxxx@glb-elkdat-01:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2021-12-10T16:37:25,338][WARN][logstash.outputs.elasticsearch][Forti_IPS] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_fccsa:xxxxxx@glb-elkdat-01:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_fccsa:xxxxxx@glb-elkdat-01:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} ``` So I belive the problem is in the command-line that I use to generate this certificate on my elasticsearch master node, follows the cli I used. # /usr/share/elasticsearch/bin/elasticsearch-certutil cert -multiple --ca elastic-stack-ca.p12 I tried # bin/elasticsearch-certutil cert --keep-ca-key --multiple --pem command too, not works in the logstash side, In the case of pkcs12 certificate, I convert them to .pem file running: openssl pkcs12 -in proxy-scbraganca.p12 -out proxy-scbraganca.crt.pem -clcerts -nokeys So, what I'm doing wrong with this certificate generation? ---
**Author:** ![Leandro\_Valim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_valim/32/93886_2.png) [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Post date:** [December 10, 2021, 7:51pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/13 "2021-12-10T19:51:48Z")
Follow an output example of this pipeline configuration. ```auto output { elasticsearch { hosts => ["https://hostname-of-elasticsearch:9200"] #ssl => true ssl_certificate_verification => false cacert => "/opt/certs/certifitcate-crt.pem" #ilm_enabled => false user => logstash_fccsa password => password index => "ksc_index-%{+YYYY.MM.dd}" } stdout { codec => rubydebug } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 7, 2022, 7:52pm UTC](https://discuss.elastic.co/t/problems-with-logstash-pipeline-to-elasticsearch/290936/14 "2022-01-07T19:52:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.