# Error: Expected one of #, =\> at line

**URL:** <https://discuss.elastic.co/t/error-expected-one-of-at-line/103579>\
**Category:** Logstash\
**Created:** [October 11, 2017, 4:10pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579 "2017-10-11T16:10:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\
**Post date:** [October 11, 2017, 4:10pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579/1 "2017-10-11T16:10:47Z")

</div>

I have Logstash Kibana and Elasticsearch (all version 5.6.2) configured and running on Windows Server 2012 R2, running through a remote desktop connection. I am working on my logstash config file to read data from a .txt file and output to elasticsearch then to kibana. I can't figure out for the life of me why I am getting errors on my config file and why in kibana it says no matching indices for "logstash-\*".

I am very new at this, so bear with me please!

logstash.conf:  
input {  
file {  
path =\> "//ntsvc/logs/\*.txt"  
}  
}

filter {  
grok {  
match =\> { "%{TIMESTAMP\_ISO8601}%{SPACE}Local4.%{LOGLEVEL}%{SPACE}%{IP}%{SPACE}%{CISCOTIMESTAMP}%%{SYSLOGPROG} %{GREEDYDATA:message}" }  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

The only settings i changed in logstash.yml are:  
config.test\_and\_exit: true

config.reload.automatic: true

I try to run the config file in PowerShell and get the following error:  
PS C:\ELK\logstash\> bin/logstash -f logstash.conf  
Sending Logstash's logs to C:/ELK/logstash/logs which is now configured via log4j2.properties  
[2017-10-11T11:50:07,363][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>  
"C:/ELK/logstash/modules/fb\_apache/configuration"}  
[2017-10-11T11:50:07,603][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"C  
:/ELK/logstash/modules/netflow/configuration"}  
[2017-10-11T11:50:07,690][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of #, =\> at line 10, column 144 (byte 231) after  
filter {  
grok {  
match =\> { "%{TIMESTAMP\_ISO8601}%{SPACE}Local4.%{LOGLEVEL}%{SPACE}%{IP}%{SPACE}%{CISCOTIMESTAMP}%%{SYSLOGPROG}%{GREEDYDATA:message}"

line 10 column 144 is right after the last quotation mark ".

Some sample data from the .txt file (edited for sensitive information):  
2017-09-18 00:00:01 Local4.Debug IP Sep 18 2017 00:00:01: %ASA-0-0000: UDP request discarded from IP to COVERT:IP

I run the grok filter in [grokconstructor.appspot.com](http://grokconstructor.appspot.com) and it runs correctly.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2017, 4:19pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579/2 "2017-10-11T16:19:55Z")

</div>

You need to tell grok which field you want to match against. If you compare your "match" line to the ones in the documentation you'll see what's missing in your case.

---

<div class="post-metadata">

**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\
**Post date:** [October 11, 2017, 4:25pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579/3 "2017-10-11T16:25:02Z")

</div>

I see now... I was so busy focusing on the line and column number I missed the "message =\>"

Works now, thank you!

---

<div class="post-metadata">

**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\
**Post date:** [October 11, 2017, 4:26pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579/4 "2017-10-11T16:26:08Z")

</div>

I am still getting the "Unable to fetch mapping" for "logstash-\*" in Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2017, 4:26pm UTC](https://discuss.elastic.co/t/error-expected-one-of-at-line/103579/5 "2017-11-08T16:26:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.