# Configuring the new logstash version - issues on the output Elasticsearch template for the mapping of my logs
**URL:** https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358
**Category:** Logstash
**Created:** [June 5, 2019, 12:51pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358 "2019-06-05T12:51:31Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)
#### Post date: [June 5, 2019, 12:51pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/1 "2019-06-05T12:51:31Z")
Hi Guys
I'm trying to configure the new version logstash (7.x)
Everything is working as prefect, logstash is running and I can see my logs on kibana 🙂 . BUT the mapping/parsing elasticsearch isn't working ☹
Following, the config of the new logstash :
My config file : logstash.conf
(This works fine but the template part isn't well configured I guess).
```auto
input {
kafka {
topics => ["nifi-xxx-fab","nifi-yyy-fab"]
client_id => "logstash-FAB"
group_id => "Logs-FAB"
bootstrap_servers => '10.200.175.xxx:15011,10.200.175.xxx:15012,10.200.xxx.152:15013'
consumer_threads => 3
}
}
filter {
if [type] == "weblogic-xxx" {
date {
match => ["date", "MMM d, yyyy, H:mm:ss,SSS a"]
}
}
}
output {
elasticsearch {
hosts => ["elastixxxx:xxxx", "elastixxxx:xxxx", "elastixxxx:xxxx"]
index => "logstash-%{+YYYY.MM.dd}"
**template => "/usr/share/logstash/pipeline/elasticsearch-template.json"**
template_overwrite => "true"
}
}
```
my elasticsearch-template.json looks like this :
```auto
{
"index_patterns" : "logstash-*",
"settings" : {
"index" : {
"refresh_interval" : "5s"
}
},
"mappings" : {
"dynamic_templates" : [
{
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string"
}
}
},
{
"string_fields" : {
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"fields" : {
"raw" : {
"type": "string",
"ignore_above" : 256
}
}
}
}
}
]
}
}
```
My config of the docker logstash .yml
```auto
logstash:
image: docker-virtual.artefact-repo.pole-emploi.intra/logstash/logstash:7.0.1
ports:
- "xxxx:xxxx"
- "xxxx:xxxx"
volumes:
- /nas/donapp/docke/_fsb/swmxor10/oxxx/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
- /nas/donapp/docke/_fsb/swmxor10/oixxx/logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
- /nas/donapp/docke/_fsb/swmxor10/oi071/logstash/pipeline/elasticsearch-template.json:/usr/share/logstash/pipeline/elasticsearch-template.json
```
So when I deploy logstash. I got the following erreur :
```auto
message=>"Expected one of #, input, filter, output at line 1,
```
and without the template thing, it works so I am pretty sure that the error come from the configuration of my elasticsearch-template
my old config of the template is as follow ( and this was working so fine)
```auto
{
"template" : "logstash-*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true,
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
}
}
}
} ],
"properties" : {
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"type" : "object",
"dynamic": true,
"properties" : {
"location" : { "type" : "geo_point" }
}
}
}
}
}
}
```
Thank you guys for your help.
Regards
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [June 5, 2019, 2:23pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/2 "2019-06-05T14:23:04Z")
Hi @soufian.eldouqe
Could you try this ?
```
output {
elasticsearch {
hosts => ["elastixxxx:xxxx", "elastixxxx:xxxx", "elastixxxx:xxxx"]
index => "logstash-%{+YYYY.MM.dd}"
manage_template => true
template => "/usr/share/logstash/pipeline/elasticsearch-template.json"
template_name => "elasticsearch-template"
template_overwrite => true
}
}
```
---
### Author:  [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)
#### Post date: [June 5, 2019, 2:31pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/3 "2019-06-05T14:31:09Z")
Hello,
Thank you for your answer but no it doesn't work and I still got the same error
```auto
message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1)",
```
regards,
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [June 5, 2019, 2:41pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/4 "2019-06-05T14:41:57Z")
Hello
Could you change, in your template file ?
```
"template" : "logstash-*", with "index_patterns": ["logstash-*"],
```
---
### Author:  [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)
#### Post date: [June 5, 2019, 2:45pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/5 "2019-06-05T14:45:52Z")
Hello,
That's what I already have. I think you were watching the old config.
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [June 5, 2019, 3:01pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/6 "2019-06-05T15:01:53Z")
The error show that you have a wildcard in the beginning of your logstash config file
Byte 1, line 1 means that your config start with hidden special char ...
Could you make sure you config file in UTF-8 and that's clean (use special file editor to show all special caracters like notepad++)
---
### Author:  [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)
#### Post date: [June 5, 2019, 3:34pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/7 "2019-06-05T15:34:43Z")
Thank you for your help.
I have checked my file in notepad. and I'm sure that I don't have any special char on it. My file is on ASCII format as is my old one .
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [June 5, 2019, 3:37pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/8 "2019-06-05T15:37:57Z")
Just double check with Notepad++
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2019, 3:49pm UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/9 "2019-06-05T15:49:36Z")
What is path.config set to? What command line are you using to start logstash?
---
### Author:  [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)
#### Post date: [June 6, 2019, 7:40am UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/10 "2019-06-06T07:40:17Z")
docker stack deploy oixxx -c /applis/xdocke/pur/par/oixxx.yml
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2019, 7:40am UTC](https://discuss.elastic.co/t/configuring-the-new-logstash-version-issues-on-the-output-elasticsearch-template-for-the-mapping-of-my-logs/184358/11 "2019-07-04T07:40:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.