# Error in template

**URL:** <https://discuss.elastic.co/t/error-in-template/87865>\
**Category:** Logstash\
**Created:** [June 1, 2017, 8:48am UTC](https://discuss.elastic.co/t/error-in-template/87865 "2017-06-01T08:48:54Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 8:48am UTC](https://discuss.elastic.co/t/error-in-template/87865/1 "2017-06-01T08:48:54Z")

</div>

Hi i have a problem , i am trying to run logsatsh it generaates the following error

```
:message=>"Error: Expected one of #, input, filter, output at line 34, column 1 (byte 855) after ", :level=>:error}

```

i have downloaded the deafult json template i am not able to identify the error  
my full configuration file

```
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
{
"mappings": {
"_default_": {
 "_all": {
"enabled": true,
"norms": {
  "enabled": false
}
},
"dynamic_templates": [
{
  "template1": {
    "mapping": {
      "doc_values": true,
      "ignore_above": 1024,
      "index": "not_analyzed",
      "type": "{dynamic_type}"
    },
"match": "*"
  }
}
],
"properties": {
"@timestamp": {
  "type": "date"
},
"message": {
  "type": "string",
  "index": "analyzed"
},
"offset": {
  "type": "long",
  "doc_values": "true"
},
"geoip" : {
  "type" : "object",
  "dynamic": true,
  "properties" : {
    "location" : { "type" : "geo_point" }
   }
   }
  }
 }
 },
"settings": {
"index.refresh_interval": "5s"
 },
"template": "filebeat-*"
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 1, 2017, 8:56am UTC](https://discuss.elastic.co/t/error-in-template/87865/2 "2017-06-01T08:56:51Z")

</div>

Why do you have mappings in your config file? If you want to specify mappings and have Logstash manage them, you should place the mappings in a separate file and instruct the elastic search output plugin to use it.

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 8:58am UTC](https://discuss.elastic.co/t/error-in-template/87865/3 "2017-06-01T08:58:24Z")

</div>

i followed the installation steps on digital ocean .i ran the following commands

```
 curl -O https://gist.githubusercontent.com/thisismitch/3429023e8438cc25b86c/raw/d8c479e2a1adcea8b1fe86570e42abab0f10f364/filebeat-index-template.json
 curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat-index-template.json

```

i got output

```
 {
  "acknowledged" : true
 }

```

And the json template was generated

i have specified the mappings in different file  
i concatenated all four files under conf.d to upload on the internet  
When logstash runs, it combines all the files in your config directory into one file.

02-beats-input.conf  
10-syslog-filter.conf  
30-elasticsearch-output.conf  
filebeat-index-template.json

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 1, 2017, 9:20am UTC](https://discuss.elastic.co/t/error-in-template/87865/4 "2017-06-01T09:20:49Z")

</div>

Move the template file out of the config directory as it can not be parsed as config by Logstash.

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 9:23am UTC](https://discuss.elastic.co/t/error-in-template/87865/5 "2017-06-01T09:23:55Z")

</div>

after removing template  
On your ELK Server, verify that Elasticsearch is indeed receiving the data by querying for the Filebeat index with this command:

```
curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'

```

i am recieving output

```
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
 "max_score" : 0.0,
 "hits" : []
  }
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 1, 2017, 9:25am UTC](https://discuss.elastic.co/t/error-in-template/87865/6 "2017-06-01T09:25:45Z")

</div>

Once you have uploaded the template to the cluster, which you did with your second curl request, it will apply to all matching indices.

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 9:30am UTC](https://discuss.elastic.co/t/error-in-template/87865/7 "2017-06-01T09:30:13Z")

</div>

after removing template  
On your ELK Server, verify that Elasticsearch is indeed receiving the data by querying for the Filebeat index with this command:

```
curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'

```

i am recieving output

```
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
 "max_score" : 0.0,
 "hits" : []
  }
}

```

when the template was present i was receiving input

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 9:32am UTC](https://discuss.elastic.co/t/error-in-template/87865/8 "2017-06-01T09:32:51Z")

</div>

should mappings file must contain header in their configuration files like other three files  
beats has input as header  
syslog has filter as header  
elasticsearch has output as header  
mappings file has no header

---

<div class="post-metadata">

**Author:** ![abinstephen1989](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@abinstephen1989](https://discuss.elastic.co/u/abinstephen1989)\
**Post date:** [June 1, 2017, 9:43am UTC](https://discuss.elastic.co/t/error-in-template/87865/9 "2017-06-01T09:43:05Z")

</div>

The error you mentioned  
one of #, input, filter, output at line 34, column 1 (byte 855) after ", :level=\>:error}

is resolved??

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 9:44am UTC](https://discuss.elastic.co/t/error-in-template/87865/10 "2017-06-01T09:44:20Z")

</div>

nope

---

<div class="post-metadata">

**Author:** ![abinstephen1989](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@abinstephen1989](https://discuss.elastic.co/u/abinstephen1989)\
**Post date:** [June 1, 2017, 9:46am UTC](https://discuss.elastic.co/t/error-in-template/87865/11 "2017-06-01T09:46:12Z")

</div>

"mappings": {  
"_default_": {  
**"\_all": {**  
"enabled": true,  
"norms": {  
"enabled": false  
}  
}

Can you try removing the space in starting of \_all??

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 1, 2017, 9:49am UTC](https://discuss.elastic.co/t/error-in-template/87865/12 "2017-06-01T09:49:20Z")

</div>

i mistakenly put the extra space while formatting on the website no extra space in my configuration file

still not working need help guys

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2017, 6:16am UTC](https://discuss.elastic.co/t/error-in-template/87865/13 "2017-06-02T06:16:49Z")

</div>

This is a confusing thread. What does your configuration file look like now?

---

<div class="post-metadata">

**Author:** ![AadarshKumayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aadarshkumayan/32/18790_2.png) [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\
**Post date:** [June 2, 2017, 7:10am UTC](https://discuss.elastic.co/t/error-in-template/87865/14 "2017-06-02T07:10:30Z")

</div>

thanks man  
it worked mapping file should not be present in the logstash configuration folder  
ubuntu log were having auth.log.1 but i had configured it for auth.log

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 7:10am UTC](https://discuss.elastic.co/t/error-in-template/87865/15 "2017-06-30T07:10:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.