# This conf is for PISC logs.
input {
beats {
stdin {
codec => multiline {
pattern => "^\s"
what => "previous"
}
}
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
}
filter {
date {
match => ["message", "YYYY-MM-DD HH:MM:SS"]
target => "@timestamp"
}
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} - %{IP:client}:%{POSINT:port} - %{HOSTNAME:host} - (?<log_type>[A-Za-z\s]{0,17})\n%{JAVACLASS:exception_type}: (?<stack_trace>[A-Za-z0-9\n\s.`(),:\\&]*)" }
}
}
output {
elasticsearch {
}
stdout{
codec => rubydebug
}
}
When I try to do the configtest, I get:
The given configuration is invalid. Reason: Expected one of #, => at line 4, column 15 (byte 65) after
# This conf is for PISC logs.
input {
beats {
stdin {:level=>:fatal}
Can someone help me out?