# Add logstash custom pattern error

**URL:** <https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447>\
**Category:** Logstash\
**Created:** [November 9, 2016, 7:54am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447 "2016-11-09T07:54:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tr\_ng\_Trang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tr_ng_trang/32/13053_2.png) [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\
**Post date:** [November 9, 2016, 7:54am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/1 "2016-11-09T07:54:17Z")

</div>

hi all,  
i am beginner with logstash, i have a question about custom pattern for logstash.  
I want to define new pattern for file\_type like this:  
DEFGH (?:asd?|bat|chm|cmd|com|dll|do|exe|hlp|hta|js|jse|lnk|ocx|pif|reg|scr|shb|shm|shs|vbe|vbs|vbx|vxd|wsf|wsh|xl?)  
for word is bat or chm or com ....  
i test success when test in grokconstructor page like this :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/8a5fc84ac611531e6e816b238ea45fa4a231ae2b.png)  
but when setup in on logstash like file:  
input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok {  
patterns\_dir =\> "/etc/logstash/conf.d/patterns"  
match =\> {   
"message" =\> ["%{WORD:amavis\_action} %{WORD:amavis\_category} (.%{DEFGH:file\_type},%{DATA:a})"]}  
}  
}  
output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}  
and file patterns like above it error, anyone help me pls,  
thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 9, 2016, 8:00am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/2 "2016-11-09T08:00:31Z")

</div>

Please show the full error message.

---

<div class="post-metadata">

**Author:** ![Tr\_ng\_Trang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tr_ng_trang/32/13053_2.png) [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\
**Post date:** [November 9, 2016, 8:03am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/3 "2016-11-09T08:03:47Z")

</div>

[2016-11-08T23:21:50,550][ERROR][logstash.agent] fetched an invalid config {:config=\>"input {\n beats {\n port =\> 5044\n }\n}\nfilter {\n grok {\n\tpatterns\_dir =\> {"/etc/logstash/conf.d/patterns"}\n\tmatch =\> { \t\n\t"message" =\> ["%{WORD:amavis\_action} %{WORD:amavis\_category} \(.%{DEFGH:file\_type},%{DATA:a}\)",\n\t"%{WORD:amavis\_action} %{WORD:amavis\_category} \(%{DATA:a},.%{DEFGH:file\_type},%{DATA:b}\)"\n\t\t]}\n }\n}\noutput {\n elasticsearch { hosts =\> ["localhost:9200"] }\n stdout { codec =\> rubydebug }\n}\n\n\nDEFGH (?:asd?|bat|chm|cmd|com|dll|do|exe|hlp|hta|js|jse|lnk|ocx|pif|reg|scr|shb|shm|shs|vbe|vbs|vbx|vxd|wsf|wsh|xl?)\n\n", :reason=\>"Expected one of #, =\> at line 8, column 50 (byte 109) after filter {\n grok {\n\tpatterns\_dir =\> {"/etc/logstash/conf.d/patterns""}  
thanksyou for reply, its error log, i don't know why pattern line add to end of file and say error,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 9, 2016, 8:04am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/4 "2016-11-09T08:04:59Z")

</div>

There's a brace missing; you're not closing your `filter` block before `output` starts.

---

<div class="post-metadata">

**Author:** ![Tr\_ng\_Trang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tr_ng_trang/32/13053_2.png) [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\
**Post date:** [November 9, 2016, 8:15am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/5 "2016-11-09T08:15:58Z")

</div>

i dont know, i think its problem but i check it again so brace is enough,  
can you show me exactly problem, i can't see problem.  
or you can copy my file cfg you fix it for me in reply , thanks you very much

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 9, 2016, 8:33am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/6 "2016-11-09T08:33:34Z")

</div>

You need an extra `}` before `output`. Over and out.

---

<div class="post-metadata">

**Author:** ![Tr\_ng\_Trang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tr_ng_trang/32/13053_2.png) [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\
**Post date:** [November 9, 2016, 9:02am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/7 "2016-11-09T09:02:50Z")

</div>

sry but its'still error when i add } before output, error message is same wih i post before.  
Can you give me a example about use patter direct not use pattern\_dir ?, i think it can make me check ez

---

<div class="post-metadata">

**Author:** ![Tr\_ng\_Trang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tr_ng_trang/32/13053_2.png) [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\
**Post date:** [November 10, 2016, 3:44am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/8 "2016-11-10T03:44:38Z")

</div>

can u response me soon, i really need to resolve problem :((

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2016, 3:44am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447/9 "2016-12-08T03:44:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.