I'm attempting to transcribe the auditd ingest pipeline from the filebeat module to a logstash config, and I'm hitting the following config syntax error. Any idea what I'm missing? [2017-05-08T18:05:19,699][FATAL][logstash.runner ] The given configuration is invalid. Reason: Expected o…

Hash pairs aren't separated by commas, i.e. it should be pattern_definitions => { "AUDIT_TYPE" => "^type=%{NOTSPACE:auditd.log.record_type}" "AUDIT_PREFIX" => "%{AUDIT_TYPE} msg=audit\\(%{NUMBER:auditd.log.epoch}:%{NUMBER:auditd.log.sequence}\\):(%{DATA})?" "AUDIT_KEY_VALUES" => "%{WO…

Configuration error - Transcribing auditd ingest pipeline to logstash config

Elastic Stack Logstash

jeffspahr (Jeffspahr) May 9, 2017, 12:28pm 5

Thanks! That solved it.

Topic		Replies	Views
Logstash configtest Failing Logstash	2	982	July 6, 2017
Logstash config error Expected one of [ \\t\\r\\n], \"#\", \"{\", \",\", \"]\" at line 10, column 83 Logstash	3	1793	December 7, 2020
Logstash config for using filebeat auditd module Logstash	2	2065	June 26, 2017
Help with Grok (syntax issue as well as question regarding double quotes) Logstash	8	431	June 30, 2023
Logstash config issue for a custom log file Logstash	9	885	August 3, 2018

Configuration error - Transcribing auditd ingest pipeline to logstash config

Related topics