# After parsing in logstash got error **URL:** \ **Category:** Logstash\ **Created:** [February 27, 2023, 9:53am UTC](https://discuss.elastic.co/t/after-parsing-in-logstash-got-error/326560 "2023-02-27T09:53:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![neeldey](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@neeldey](https://discuss.elastic.co/u/neeldey)\ **Post date:** [February 27, 2023, 9:53am UTC](https://discuss.elastic.co/t/after-parsing-in-logstash-got-error/326560/1 "2023-02-27T09:53:52Z")
Hi all, i getting error, while to start logstash. logstash log is as bellow. [2023-02-27T15:18:50,526][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?] at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?] [2023-02-27T15:19:11,875][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties [2023-02-27T15:19:11,892][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.17.9", "jruby.version"=\>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.18+10 on 11.0.18+10 +indy +jit [linux-x86\_64]"} [2023-02-27T15:19:11,896][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djdk.io.File.enableADS=true, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true] [2023-02-27T15:19:13,920][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600, :ssl\_enabled=\>false} [2023-02-27T15:19:15,619][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "{", "}" at line 4, column 47 (byte 93) after filter {\n if [type] == "syslog" {\n grok {\n match =\> { "message" =\> "\ device\_name="", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:392:in `block in converge\_state'"]} [2023-02-27T15:19:15,769][INFO][logstash.runner] Logstash shut down. [2023-02-27T15:19:15,785][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit org.jruby.exceptions.SystemExit: (SystemExit) exit at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?] at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?] at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?] and my logstash conf file image uploaded.Please find the attachment. ![1](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99b39a04660f26e79bbc367d9e3825bd30a75062.png) # syslog-filter.conf file as below. filter { if [type] == "syslog" { grok { match =\> { "message" =\> "\ device\_name="%{WORD:device\_name}" timestamp="%{TIMESTAMP\_ISO8601:timestamp}" device\_model="%{WORD:device\_model}" device\_serial\_id="%{WORD:device\_serial\_id}" log\_id="%{DATA:log\_id}" log\_type="%{WORD:log\_type}" log\_component="%{DATA:ignored}" log\_subtype="%{WORD:log\_subtype}" log\_version=%{INT:log\_version} severity="%{WORD:ignored}" fw\_rule\_id="%{DATA:ignored}" nat\_rule\_id="%{DATA:ignored}" fw\_rule\_type="%{DATA:ignored}" ether\_type="%{DATA:ignored}" src\_ip="%{IP:src\_ip}" src\_country="%{WORD:src\_country}" dst\_ip="%{IP:dst\_ip}" dst\_country="%{WORD:dst\_country}" protocol="%{DATA:ignored}" src\_port=%{INT:src\_port} dst\_port=%{INT:dst\_port} hb\_status="%{DATA:ignored}" %{GREEDYDATA:message}"" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } my syslem log : \_gateway device\_name="SFW" timestamp="2023-02-27T14:06:26+0530" device\_model="XG310" device\_serial\_id="C320AB9KCCKVQEA" log\_id="010202601001" log\_type="Firewall" log\_component="Invalid Traffic" log\_subtype="Denied" log\_version=1 severity="Information" fw\_rule\_id="N/A" nat\_rule\_id="0" fw\_rule\_type="NETWORK" ether\_type="IPv4 (0x0800)" src\_ip="10.100.12.100" src\_country="R1" dst\_ip="34.120.208.123" dst\_country="USA" protocol="TCP" src\_port=50780 dst\_port=443 hb\_status="No Heartbeat" message="Could not associate packet to any connection." app\_resolved\_by="Signature" app\_is\_cloud="FALSE" qualifier="New" Please guide my how can I parse this log files. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 27, 2023, 5:09pm UTC](https://discuss.elastic.co/t/after-parsing-in-logstash-got-error/326560/2 "2023-02-27T17:09:49Z")
> [@neeldey](#): > > "message" =\> "\ device\_name="%{WORD:device\_name}" If you have double quotes inside a string surrounded by double quotes then you have to escape them using a backslash. That said, you might be better off using a kv filter to parse that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 27, 2023, 5:10pm UTC](https://discuss.elastic.co/t/after-parsing-in-logstash-got-error/326560/3 "2023-03-27T17:10:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.