Hi,
I'm new in ELK and i'm having a problem with logstash trying to filter my application log.
This is my config file:
input {
file {
path => "/var/log/application/application.log"
start_position => "beginning"
type => "logs"
}
filter {
grok {
match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log_level} [%{DATA:thread}] %{JAVACLASS:class} %{GREEDYDATA:message}" ]
}
}
}
output {
elasticsearch {
hosts => "localhost:9200>"
index => "logstash-%{+YYYY.MM.dd}"
}
}
And this is the error i get:
[2017-10-25T15:43:23,420][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, => at line 8, column 10 (byte 162) after input {\n file {\n path => "/var/log/application/application.log"\n start_position => "beginning"\n type => "logs"\n }\n filter {\n grok "}
Also tried with codec multiline but got same error:
[2017-10-25T15:19:37,483][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, { at line 7, column 9 (byte 150) after input {\n file {\n path => "/var/log/application/application.log"\n start_position => "beginning"\n type => "logs"\n }\n codec "}
I thought maybe i had not plugins installed but they are by default:
/usr/share/logstash/bin/logstash-plugin list
logstash-codec-cef
logstash-codec-collectd
logstash-codec-dots
logstash-codec-edn
logstash-codec-edn_lines
logstash-codec-es_bulk
logstash-codec-fluent
logstash-codec-graphite
logstash-codec-json
logstash-codec-json_lines
logstash-codec-line
logstash-codec-msgpack
logstash-codec-multiline
logstash-codec-netflow
logstash-codec-plain
logstash-codec-rubydebug
logstash-filter-cidr
logstash-filter-clone
logstash-filter-csv
logstash-filter-date
logstash-filter-dissect
logstash-filter-dns
logstash-filter-drop
logstash-filter-fingerprint
logstash-filter-geoip
logstash-filter-grok
logstash-filter-json
logstash-filter-kv
logstash-filter-metrics
logstash-filter-mutate
logstash-filter-ruby
logstash-filter-sleep
logstash-filter-split
logstash-filter-syslog_pri
logstash-filter-throttle
logstash-filter-translate
logstash-filter-urldecode
logstash-filter-useragent
logstash-filter-uuid
logstash-filter-xml
logstash-input-beats
logstash-input-couchdb_changes
logstash-input-dead_letter_queue
logstash-input-elasticsearch
logstash-input-exec
logstash-input-file
logstash-input-ganglia
logstash-input-gelf
logstash-input-generator
logstash-input-graphite
logstash-input-heartbeat
logstash-input-http
logstash-input-http_poller
logstash-input-imap
logstash-input-irc
logstash-input-jdbc
logstash-input-kafka
logstash-input-log4j
logstash-input-lumberjack
logstash-input-pipe
logstash-input-rabbitmq
logstash-input-redis
logstash-input-s3
logstash-input-snmptrap
logstash-input-sqs
logstash-input-stdin
logstash-input-syslog
logstash-input-tcp
logstash-input-twitter
logstash-input-udp
logstash-input-unix
logstash-input-xmpp
logstash-output-cloudwatch
logstash-output-csv
logstash-output-elasticsearch
logstash-output-file
logstash-output-graphite
logstash-output-http
logstash-output-irc
logstash-output-kafka
logstash-output-nagios
logstash-output-null
logstash-output-pagerduty
logstash-output-pipe
logstash-output-rabbitmq
logstash-output-redis
logstash-output-s3
logstash-output-sns
logstash-output-sqs
logstash-output-statsd
logstash-output-stdout
logstash-output-tcp
logstash-output-udp
logstash-output-webhdfs
logstash-output-xmpp
logstash-patterns-core
Can you help me? Any thoughts?