# Cannot load an invalid configuration in logstash.conf

**URL:** https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491
**Category:** Logstash
**Created:** [May 4, 2017, 6:33am UTC](https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491 "2017-05-04T06:33:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![aarishramesh](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)
#### Post date: [May 4, 2017, 6:33am UTC](https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491/1 "2017-05-04T06:33:00Z")

</div>

I am trying to configure logstash for the following inputs - nginx access, nginx error & logs following a custom pattern & below is the logstash.conf

```
input {
    beats {
    port => 5044

codec => multiline {
  # Grok pattern names are valid! :)
  pattern => "^%{TIMESTAMP_ISO8601} "
  negate => true
  what => previous
    }
}
}

filter {

if [type] == "nginx-access" {
    grok {
    match => ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
    overwrite => ["message"]
    }

    mutate {
            convert => ["response", "integer"]
            convert => ["bytes", "integer"]
            convert => ["responsetime", "float"]
    }

    geoip {
            source => "clientip"
            target => "geoip"
            add_tag => ["nginx-geoip"]
    }
      
    date {
            match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
            remove_field => ["timestamp"]
    }
 
    useragent { 
            source => "agent"
    }

} else if [type] == "nginx-error" { 
    grok {
    match => ["message" , "(?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- 
]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %
{GREEDYDATA:errormessage}(?:, client: (?<client>%{IP}|%{HOSTNAME}))(?:, server: %
{IPORHOST:server})(?:, request: %{QS:request})?(?:, upstream: \"%{URI:upstream}\")?(?:, host: 
%
{QS:host})?(?:, referrer: \"%{URI:referrer}\")"] 
    overwrite => ["message"]
    }

geoip {
            source => "client"
            target => "geoip"
            add_tag => ["nginx-geoip"]
    }

    date {
            match => ["timestamp" , "YYYY/MM/dd HH:mm:ss"]
            remove_field => ["timestamp"]
    }

} else {

  mutate {
  gsub => ["message", "\n", " "]
}
  grok {
match => ["message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:uid}\] \[%
{NOTSPACE:thread}\] %{LOGLEVEL:loglevel} %{DATA:class}\-%{GREEDYDATA:message}" ]
overwrite => ["message"]
}
date {
match => ["timestamp" , "yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
if "_grokparsefailure" in [tags] {
         drop { }
}
}
}

output {

stdout { codec => rubydebug }
if [type] == "nginx-access" {
 elasticsearch { hosts => localhost }
 index => "nginx-access-%{+YYYY.MM.dd}"
} else if [type] == "nginx-error" {
 elasticsearch { hosts => localhost }
index => "nginx-error-%{+YYYY.MM.dd}"
} else {
 elasticsearch { hosts => localhost }
}

}

```

But on running it, I get the following error

ERROR logstash.agent - Cannot load an invalid configuration {:reason=\>"Expected one of #, {  
at line 84, column 9 (byte 1883) after output {\n \nstdout { codec =\> rubydebug }\nif [type] ==  
"nginx-access" {\n elasticsearch { hosts =\> localhost }\n index "}

I am not sure what the error is. Can someone help me figure it out ?

---

<div class="post-metadata">

### Author: ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 4, 2017, 7:08am UTC](https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491/2 "2017-05-04T07:08:02Z")

</div>

> elasticsearch { hosts =\> localhost }  
> index =\> "nginx-access-%{+YYYY.MM.dd}"

Try:

```auto
elasticsearch { 
  hosts => ["localhost:9200"] (or another port depending of your conf)
  index => "nginx-access-%{+YYYY.MM.dd}"
}

```

Index shall be in elasticsearch object, not outside

---

<div class="post-metadata">

### Author: ![aarishramesh](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)
#### Post date: [May 4, 2017, 7:14am UTC](https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491/3 "2017-05-04T07:14:39Z")

</div>

It worked on doing the change. Thanks a lot

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 1, 2017, 7:17am UTC](https://discuss.elastic.co/t/cannot-load-an-invalid-configuration-in-logstash-conf/84491/4 "2017-06-01T07:17:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.