🚨 Logstash Error Guide: 'Could not execute action: PipelineAction::Create' — Fix the Failing Pipeline Config

Overview

When Logstash tries to instantiate a pipeline and the pipeline’s configuration cannot be compiled into a running graph, the converge loop reports a PipelineAction::Create failure:

[ERROR][logstash.agent] Failed to execute action
{:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction,
 :message=>"Could not execute action: PipelineAction::Create<main>,
 action_result: false", :backtrace=>nil}

This is a wrapper. The real cause is almost always a second line just above or below it — a ConfigurationError, a NoMethodError from a plugin’s register, a missing plugin, or an invalid setting. PipelineAction::Create failing simply means “the pipeline could not be built”; you must read the surrounding lines to learn why.

Symptoms

• Failed to execute action ... PipelineAction::Create<pipeline_id>, action_result: false in the log.
• On startup, the pipeline never reaches the Pipeline started line for that pipeline.id.
• During a hot config reload (--config.reload.automatic or SIGHUP), the running pipeline keeps working but the new version fails to converge.
• _node/pipelines shows the pipeline missing or in a failed state.
• Multiple pipelines defined and only one fails to create, leaving a partial deployment.

Common Root Causes

• Configuration syntax error — an unclosed brace, a missing =>, or an invalid conditional in the .conf.
• Unknown or uninstalled plugin — a filter/output referencing a plugin not present in bin/logstash-plugin list.
• Invalid plugin settings — a required option missing, a wrong type, or a value the plugin rejects in register.
• Bad pipelines.yml settings — an invalid pipeline.workers value, a duplicate pipeline.id, or a malformed YAML entry.
• Environment variable not resolved — ${ES_HOST} referenced without the variable set, producing an empty/invalid value.
• Reload of a broken config — automatic reload picked up a file mid-edit that does not compile.

Diagnostic Workflow

Read the lines immediately around the PipelineAction::Create message — the true error is there:

grep -B3 -A15 'PipelineAction::Create' /var/log/logstash/logstash-plain.log | tail -40

Validate the configuration with the config test, which surfaces the underlying ConfigurationError clearly:

sudo -u logstash /usr/share/logstash/bin/logstash \
  --path.settings /etc/logstash --config.test_and_exit

Check that every referenced plugin is installed:

/usr/share/logstash/bin/logstash-plugin list | grep -E 'kafka|jdbc|http|s3'

Inspect pipelines.yml for duplicate IDs or invalid settings:

# /etc/logstash/pipelines.yml — a duplicate pipeline.id causes Create to fail
- pipeline.id: main
  path.config: "/etc/logstash/conf.d/main.conf"
  pipeline.workers: 4
- pipeline.id: main            # DUPLICATE -> PipelineAction::Create fails
  path.config: "/etc/logstash/conf.d/extra.conf"

Confirm environment variables used in the config are actually present for the service user:

systemctl show logstash -p Environment
sudo -u logstash bash -c 'echo "ES_HOST=$ES_HOST"'

After fixing, reload without a full restart and verify convergence:

kill -SIGHUP $(pgrep -f org.logstash.Logstash)   # if config.reload.automatic is off
curl -s localhost:9600/_node/pipelines?pretty | grep -A2 '"main"'

Example Root Cause Analysis

A pipeline that worked in staging failed in production with Could not execute action: PipelineAction::Create<main>, action_result: false. The wrapper alone was uninformative, so the operator ran --config.test_and_exit and got the real message: Couldn't find any output plugin named 'elasticsearch_data_stream'. Are you sure this is correct?

Staging had a newer Logstash with the data-stream output; production ran an older build where that plugin name did not exist. logstash-plugin list | grep elasticsearch confirmed only logstash-output-elasticsearch was installed. Rather than downgrade the config, they set data_stream => true on the standard elasticsearch output (supported in the installed version) instead of the nonexistent plugin name. --config.test_and_exit passed, a SIGHUP reloaded the pipeline, and _node/pipelines showed main running.

Prevention Best Practices

• Never read PipelineAction::Create in isolation — always grep the surrounding lines or run --config.test_and_exit for the underlying error.
• Gate every deploy with logstash --config.test_and_exit in CI so syntax errors and missing plugins fail the build, not the node.
• Pin plugin versions and keep the installed plugin set identical across environments to avoid “unknown plugin” surprises.
• Validate pipelines.yml for duplicate pipeline.id values and correct types before rollout.
• Provide all referenced environment variables via the systemd unit or an EnvironmentFile, and fail fast if a required one is empty.
• When using automatic reload, edit configs atomically (write to a temp file and mv) so the reloader never sees a half-written, non-compiling file.

Quick Command Reference

# Find the REAL error behind the wrapper
grep -B3 -A15 'PipelineAction::Create' /var/log/logstash/logstash-plain.log | tail -40

# Validate config offline
sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t

# Confirm plugins are installed
/usr/share/logstash/bin/logstash-plugin list

# Check env vars the config depends on
systemctl show logstash -p Environment

# Reload and verify convergence
kill -SIGHUP $(pgrep -f org.logstash.Logstash)
curl -s localhost:9600/_node/pipelines?pretty

Conclusion

Could not execute action: PipelineAction::Create is a wrapper meaning “the pipeline could not be built” — the actionable error is always in the adjacent log lines or exposed by --config.test_and_exit. Typical culprits are config syntax errors, uninstalled or misnamed plugins, invalid plugin settings, duplicate pipeline.ids, and unresolved environment variables. Make logstash -t a required gate in your deploy pipeline and keep plugin sets consistent across environments, and this converge failure stops reaching production.