# Could not find the error in logstash CONF
**URL:** https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991
**Category:** Logstash
**Created:** [December 26, 2016, 9:36am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991 "2016-12-26T09:36:59Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)
#### Post date: [December 26, 2016, 9:36am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/1 "2016-12-26T09:36:59Z")
I have a logstash configuration which has the below error...
> [2016-12-26T01:24:22,031][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of #, =\> at line 47, column 17 (byte 2592) after filter { .....
my configuration is
```
input {
file {
path => ["C:\Users\547213\elk\tutorialdata\www4\accesslogwithmultipleGROKpattern.LOG"]
type => "accesslogwithmultipleGROKpattern"
start_position => "beginning"
}
}
filter {
grok{
match => { 'message' => '%{IP:IP Address} \- \- \[%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME}\] \"%{WORD:Method} \/%{DATA:Page}\?%{GREEDYDATA:PageMessage}'}
}
if[Page] == "product.screen" {
grok {
match => { 'PageMessage' => 'productId=%{DATA:ProductID}\&JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
if[Page] == "cart.do" {
grok {
match => { 'PageMessage' => 'action=%{DATA:Action}\&itemId=%{DATA:ItemID}\&productId=%{DATA:ProductId}\&JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
if[Page] == "oldlink" {
grok {
match => { 'PageMessage' => 'itemId=%{DATA:ItemID}\&JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
if[Page] == "category.screen" {
grok {
match => { 'PageMessage' => 'categoryId=%{DATA:CategoryId}\&JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
if[Page] == "cart/success.do" {
grok {
match => { 'PageMessage' => 'JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
if[Page] == "error.do" {
grok {
match => { 'PageMessage' => 'msg=%{WORD:ErrorMessage}\&JSESSIONID=%{DATA:JSessionID} %{WORD:Protocol} %{BASE16FLOAT:HTTPVersion}\" %{INT:StatusCode} %{INT:SizeoftheObjectReturned} \"%{URI}\" \"%{WORD:BrowserProduct}\/%{BASE16FLOAT:BrowserVersion} \(%{GREEDYDATA:PlatformAndConfiguration}\" %{INT:ActionCode} '}
}
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
```
The line 47 column 17 is **_elasticsearch { hosts =\> ["localhost:9200"] }_** in output plugin
I tried different ways to solve but nothing works. Could anyone help solving this?
Thank you.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 26, 2016, 9:47am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/2 "2016-12-26T09:47:12Z")
As far as I can tell, the curly braces in your filter block does not seem to match up properly.
---
### Author:  [@slinky](https://discuss.elastic.co/u/slinky)
#### Post date: [December 26, 2016, 3:35pm UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/3 "2016-12-26T15:35:13Z")
Yea, you need to add some closing braces before:
> [@VijayKarthikeyan](#):
>
> output {
---
### Author:  [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)
#### Post date: [December 27, 2016, 5:46am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/4 "2016-12-27T05:46:06Z")
Thank you Christian.. got it and i have cleared.
---
### Author:  [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)
#### Post date: [December 27, 2016, 5:46am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/5 "2016-12-27T05:46:34Z")
Thank you slinky
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 24, 2017, 5:46am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991/6 "2017-01-24T05:46:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.