# Documented Logstash X-pack config breaks Logstash
**URL:** https://discuss.elastic.co/t/documented-logstash-x-pack-config-breaks-logstash/89539
**Category:** Logstash
**Created:** [June 15, 2017, 10:24am UTC](https://discuss.elastic.co/t/documented-logstash-x-pack-config-breaks-logstash/89539 "2017-06-15T10:24:35Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@bjorn](https://discuss.elastic.co/u/bjorn)
#### Post date: [June 15, 2017, 10:24am UTC](https://discuss.elastic.co/t/documented-logstash-x-pack-config-breaks-logstash/89539/1 "2017-06-15T10:24:35Z")
The official Elasticsearch output plugin documentation ([https://www.elastic.co/guide/en/x-pack/current/logstash.html](https://www.elastic.co/guide/en/x-pack/current/logstash.html)) says that username and password should be added to each of input {}, filter {}, and the Elasticsearch output. However, when using the documented config, Logstash refuses to start.
When username/password is added to the input{} section, the log says:
`[2017-06-15T12:19:22,223][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, { at line 10, column 8 (byte 112) after input {\n tcp {\n port => 5000\n type => syslog\n }\n udp {\n port => 5000\n type => syslog\n }\n user "}`
When username/password is added to the filter{} section, the log says:
`[2017-06-15T12:23:32,696][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, { at line 25, column 8 (byte 603) after filter {\n if [type] == \"syslog\" {\n grok {\n match => { \"message\" => \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}\" }\n add_field => [\"received_at\", \"%{@timestamp}\"]\n add_field => [\"received_from\", \"%{host}\"]\n }\n date {\n match => [\"syslog_timestamp\", \"MMM d HH:mm:ss\", \"MMM dd HH:mm:ss\"]\n }\n }\n user "}`
Please update the documentation.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 19, 2017, 3:07am UTC](https://discuss.elastic.co/t/documented-logstash-x-pack-config-breaks-logstash/89539/2 "2017-06-19T03:07:54Z")
You are correct, the samples in the documentation are not very clear.
You only need to add `user` and `password` if you are using the `elasticsearch` input and filter plugins. In your case it looks like you're using the `tcp` input and `grok` filter, so no configuration changes are needed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 17, 2017, 3:07am UTC](https://discuss.elastic.co/t/documented-logstash-x-pack-config-breaks-logstash/89539/3 "2017-07-17T03:07:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.