# Debugging pipeline rules

**URL:** https://community.graylog.org/t/debugging-pipeline-rules/1463
**Category:** Graylog Central (peer support)
**Tags:** debuggingpl, pipeline-rules
**Created:** [June 15, 2017, 12:12pm UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463 "2017-06-15T12:12:29Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)
#### Post date: [June 15, 2017, 12:12pm UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463/1 "2017-06-15T12:12:29Z")

</div>

hi,

where can I find the errors in the pipeline rules? The pipeline page tells me that there are quite a lot of errors, but I cannot see them in the server logs. I would like to see what causes the problems.

---

<div class="post-metadata">

### Author: ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [June 16, 2017, 3:22pm UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463/2 "2017-06-16T15:22:01Z")

</div>

> [@jtkarvo](#):
>
> The pipeline page tells me that there are quite a lot of errors

Where and what do you see exactly?

---

<div class="post-metadata">

### Author: ![msteele](https://avatars.discourse-cdn.com/v4/letter/m/94ad74/32.png) [@msteele](https://community.graylog.org/u/msteele)
#### Post date: [June 16, 2017, 7:24pm UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463/3 "2017-06-16T19:24:26Z")

</div>

In /var/logs/graylog/server/current I see the following:

`2017-06-16 19:08:13,225 WARN : org.graylog2.shared.events.DeadEventLoggingListener - Received unhandled event of type <org.graylog.plugins.pipelineprocessor.processors.PipelineInterpreter.State> from event bus <AsyncEventBus{graylog-eventbus}>`

I assume this is a problem with the pipeline rule I just added?

```
rule "parse ACCESS log timestamp"
when
    has_field("event_ts")
then
    set_field("timestamp", $message.event_ts);    
end

```

So how can I debug this rule further? The error above is pretty cryptic.

---

<div class="post-metadata">

### Author: ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)
#### Post date: [June 17, 2017, 5:29am UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463/4 "2017-06-17T05:29:25Z")

</div>

I saw these, too. And on the pipeline page there was info like 2 msg/s errors 2 msg/sec. (I have no access to the graylog right now).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [July 1, 2017, 5:30am UTC](https://community.graylog.org/t/debugging-pipeline-rules/1463/5 "2017-07-01T05:30:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.