# ERROR logstash.agent - Cannot load an invalid configuration

**URL:** <https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441>\
**Category:** Logstash\
**Created:** [May 19, 2017, 2:32pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441 "2017-05-19T14:32:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![teejayuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teejayuu/32/18356_2.png) [@teejayuu](https://discuss.elastic.co/u/teejayuu)\
**Post date:** [May 19, 2017, 2:32pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441/1 "2017-05-19T14:32:23Z")

</div>

Hi

ELK installed on Windows 2012 R2 and trying to capture Exchange message tracking. Everything is in D:\ELK and have ELK 5.3.2.

Running the command:  
`D:\ELK\logstash-5.3.2\bin\logstash -f D:\ELK\logstash-5.3.2\01-inputs.conf\exchange_msg_trk.conf --debug`  
...I get this error:  
`14:47:16.131 [LogStash::Runner] ERROR logstash.agent - Cannot load an invalid configuration {:reason=>"Expected one of #, } at line 38, column 32 (byte 1315) after output {\n elasticsearch { host => 127.0", :backtrace=>["D:/ELK/logstash-5.`

My exchange\_msg\_trk.conf looks like this:

```
 #udp syslogs stream via 5141
input {
  udp {
    type => "Exchange"
    port => 5141
  }
}

filter {
  if [type] == "Exchange" {
    csv {
            add_tag => ['exh_msg_trk']
            columns => ['logdate', 'client_ip', 'client_hostname', 'server_ip', 'server_hostname', 'source_context', 'connector_id', 'source', 'event_id', 'internal_message_id', 'message_id', 'network_message_id', 'recipient_address', 'recipient_status', 'total_bytes', 'recipient_count', 'related_recipient_address', 'reference', 'message_subject', 'sender_address', 'return_path', 'message_info', 'directionality', 'tenant_id', 'original_client_ip', 'original_server_ip', 'custom_data']
        remove_field => ["logdate"]
        }
    grok {
        match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"]
        }
    mutate {
        convert => ["total_bytes", "integer"]
        convert => ["recipient_count", "integer"]
        split => ["recipient_address", ";"]
        split => ["source_context", ";"]
        split => ["custom_data", ";"]
          }
    date {
        match => ["timestamp", "ISO8601"]
        timezone => "Europe/London"
        remove_field => ["timestamp"]
        }
    if "_grokparsefailure" in [tags] {
          drop { }
        }
    }
}

output {
  elasticsearch { hosts => 10.20.0.29:9200 }
  stdout { codec => rubydebug }
}

```

I have tried all permutations I can think of for hosts =\> localhost, 127.0.0.1, hostname, with and without quotes, checked the file for invalid characters and am at a loss in solving this.

Could someone look at this with a fresh pair of eyes?  
Thanks

---

<div class="post-metadata">

**Author:** ![teejayuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teejayuu/32/18356_2.png) [@teejayuu](https://discuss.elastic.co/u/teejayuu)\
**Post date:** [May 19, 2017, 3:25pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441/2 "2017-05-19T15:25:34Z")

</div>

Solved. Changed  
`elasticsearch { hosts => 10.20.0.29:9200 }`  
to  
`elasticsearch { hosts => ["localhost:9200"] }`  
and it's working great

---

<div class="post-metadata">

**Author:** ![mw\_jko](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@mw\_jko](https://discuss.elastic.co/u/mw_jko)\
**Post date:** [May 19, 2017, 3:34pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441/3 "2017-05-19T15:34:11Z")

</div>

Maybe you issue were just the missing quotes around the host. Just checked my config an I have something like hosts =\> "IP:PORT" in it (no array notation).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2017, 3:34pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441/4 "2017-06-16T15:34:57Z")

</div>

Closed on June 16, 2017, 3:34pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.