hi @tahseen_fatima this is the code I used and got the error below
---------------SETTING IN FILEBEAT---------------------
--- # Change to true to enable this input configuration.
enabled: true
-# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/*.log
#- C:\ProgramData\filebeat\logs\atg\Rev4*.json
- D:\Logs\Rev4*.json
- D:\Logs\Rev5*.json
close_removed: true
--------------------logstash config CODE USED----------------------------
input
{
beats
{
port => "5044"
codec => "json"
include_codec_tag => false
}
}
output
{
if [path] == "D:\Logs\Rev4"{
stdout { codec => rubydebug }
elasticsearch
{
hosts => "localhost:9200"
index => "Rev4"
}
else if [path] == "D:\Logs\Rev5"{
stdout { codec => rubydebug }
{
hosts => "localhost:9200"
index => "Rev5"
}
}
-------ERROR AT LOGSTASHOUTPUT---------------------
[2021-01-25T09:53:02,106][DEBUG][logstash.agent ] Executing action {:action=>LogStash::PipelineAction::Create/pipeline_id:main}
[2021-01-25T09:53:02,473][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "and", "or", "xor", "nand", "{" at line 17, column 13 (byte 196) after output \n{\n\tif [path] == "D:\Logs\Rev4\"{\nstdout { codec => rubydebug }\n\telasticsearch \n\t{ \n\t\thosts => "", :backtrace=>["D:/Kibana/logstash-7.10.1/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in
initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in initialize'", "D:/Kibana/logstash-7.10.1/logstash-core/lib/logstash/java_pipeline.rb:47:in
initialize'", "D:/Kibana/logstash-7.10.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "D:/Kibana/logstash-7.10.1/logstash-core/lib/logstash/agent.rb:365:in
block in converge_state'"]}
[2021-01-25T09:53:02,517][DEBUG][logstash.instrument.periodicpoller.os] Stopping