# Error: Expected one of #, {, ,, \]

**URL:** <https://discuss.elastic.co/t/error-expected-one-of/137891>\
**Category:** Logstash\
**Created:** [June 29, 2018, 3:12am UTC](https://discuss.elastic.co/t/error-expected-one-of/137891 "2018-06-29T03:12:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcelo](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@marcelo](https://discuss.elastic.co/u/marcelo)\
**Post date:** [June 29, 2018, 3:12am UTC](https://discuss.elastic.co/t/error-expected-one-of/137891/1 "2018-06-29T03:12:47Z")

</div>

I noticed that over time my logstash stops receiving information from my filebeats, analyzing the log I am getting this error message:

[2018-06-28T23:55:46,344][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, ", ', -, [, { at line 15, column 27 (byte 754) after filter {\n if "PJE-PROFILER" in [tags] {\n grok {\n match =\> { "message" =\> '^%{DATA:PROFILER\_uuid};%{WORD:PROFILER\_request\_status};%{WORD:PROFILER\_method};%{URI:PROFILER\_url};%{WORD:PROFILER\_year};%{WORD:PROFILER\_\nmonth};%{WORD:PROFILER\_day};%{WORD:PROFILER\_hour};%{WORD:PROFILER\_minute};%{WORD:PROFILER\_second};%{WORD:PROFILER\_millisecond};(?:%{INT:PROFILER\_Nao\_sei});(?:%{INT:PROF\nILER\_elapsed\_time\_request}|);%{IPV4:clientip};%{DATA:PROFILER\_thread};%{DATA:PROFILER\_session};%{DATA:PROFILER\_session\_id};%{DATA:PROFILER\_user\_id};%{DATA:PROFILER\_user\n\_name};%{DATA:PROFILER\_profile};%{DATA:PROFILER\_agent};'}\n }\n if "tjpe.gov.br" in [beat][hostname] {\n mutate {\n add\_field =\> {\n "NODE\_UNION" =\> ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]}

My file:

```
input { 
  stdin { }
}
filter {
  if "PJE-PROFILER" in [tags] {
    grok {
      match => { "message" => '^%{DATA:PROFILER_uuid};%{WORD:PROFILER_request_status};%{WORD:PROFILER_method};%{URI:PROFILER_url};%{WORD:PROFILER_year};%{WORD:PROFILER_month};%{WORD:PROFILER_day};%{WORD:PROFILER_hour};%{WORD:PROFILER_minute};%{WORD:PROFILER_second};%{WORD:PROFILER_millisecond};(?:%{INT:PROFILER_Nao_sei});(?:%{INT:PROFILER_elapsed_time_request}|);%{IPV4:clientip};%{DATA:PROFILER_thread};%{DATA:PROFILER_session};%{DATA:PROFILER_session_id};%{DATA:PROFILER_user_id};%{DATA:PROFILER_user_name};%{DATA:PROFILER_profile};%{DATA:PROFILER_agent};'}
    }
    if "mydomain" in [beat][hostname]{
      mutate {
        add_field => {
          "NODE_UNION" => %{[beat][hostname]}
        }
      }
      mutate {
        gsub => [
          "NODE_UNION", ".mydomain", ""
        ]
      }
    }
    mutate {
      add_field => {
        "timestamp" => "%{PROFILER_day}/%{PROFILER_month}/%{PROFILER_year}:%{PROFILER_hour}:%{PROFILER_minute}:%{PROFILER_second}.%{PROFILER_millisecond} -0300"
      }
      remove_field => ["message" ,"PROFILER_Nao_sei", "clientip"]
    }
    date {
      match => ["timestamp", "dd/MM/YYYY:HH:mm:ss.SSS Z"]
    }
  }
}
output {
  elasticsearch {
    hosts => [
      "localhost:9200"
    ]
  }
  stdout {
    codec => rubydebug
  }
}

```

i cant identify where is the problem.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 29, 2018, 6:23am UTC](https://discuss.elastic.co/t/error-expected-one-of/137891/2 "2018-06-29T06:23:24Z")

</div>

> ```
> "NODE_UNION" => %{[beat][hostname]}
> 
> ```

Have you tried quoting the string?

```
      "NODE_UNION" => "%{[beat][hostname]}"

```

---

<div class="post-metadata">

**Author:** ![marcelo](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@marcelo](https://discuss.elastic.co/u/marcelo)\
**Post date:** [June 29, 2018, 7:57am UTC](https://discuss.elastic.co/t/error-expected-one-of/137891/3 "2018-06-29T07:57:18Z")

</div>

yes, not working.

I change to :  
if "nameofmyserver.mydomain" in [beat][hostname]{  
mutate {  
add\_field =\> {  
"NODE\_UNION" =\> "nameofmyserver"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2018, 7:57am UTC](https://discuss.elastic.co/t/error-expected-one-of/137891/4 "2018-07-27T07:57:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.