# Error to run logstash **URL:** \ **Category:** Logstash\ **Created:** [August 12, 2016, 9:03pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957 "2016-08-12T21:03:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rai](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@rai](https://discuss.elastic.co/u/rai)\ **Post date:** [August 12, 2016, 9:03pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/1 "2016-08-12T21:03:46Z")
`indent preformatted text by 4 spaces`I got following error on console when tried to start the logstash. root@111:/opt/logstash/bin# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/10-syslog-filter.conf --configtest Error: Expected one of #, =\> at line 4, column 18 (byte 39) after filter { grok { PATHELEM {:level=\>:error} Here is my logstash conf file: filter { grok { PATHELEM`indent preformatted text by 4 spaces` [^/]+ TASKPATH ^/var/lib/mesos/slave/slaves/%{PATHELEM:agent}/frameworks/%{PATHELEM:framework}/executors/%{PATHELEM:executor}/runs/%{PATHELEM:run} match =\> ["file" , "%{TASKPATH}"] } } ---
**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Post date:** [August 12, 2016, 9:56pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/2 "2016-08-12T21:56:25Z")
Can you paste the entire config. Please use the code formatting. It is very difficult to read the JSON. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 14, 2016, 2:15pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/3 "2016-08-14T14:15:13Z")
> grok { > PATHELEMindent preformatted text by 4 spaces [^/]+ > TASKPATH ^/var/lib/mesos/slave/slaves/%{PATHELEM:agent}/frameworks/%{PATHELEM:framework}/executors/%{PATHELEM:executor}/runs/%{PATHELEM:run} > match =\> ["file" , "%{TASKPATH}"] > } > } Is this _actually_ what your configuration looks like? You simply can't define new grok patterns inside the grok filter. You have to define them in a separate file. ---
**Author:** ![rai](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@rai](https://discuss.elastic.co/u/rai)\ **Post date:** [August 15, 2016, 2:51am UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/4 "2016-08-15T02:51:50Z")
thank you so much. I will make this change and try. ---
**Author:** ![rai](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@rai](https://discuss.elastic.co/u/rai)\ **Post date:** [August 15, 2016, 3:43pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/5 "2016-08-15T15:43:34Z")
I crate a separate pattern file under pattern directory and content of this file is : THELEM [^/]+ TASKPATH ^/var/lib/mesos/slave/slaves/%{PATHELEM:agent}/frameworks/% `indent preformatted text by 4 spaces`{PATHELEM:framework}/executors/% `indent preformatted text by 4 spaces`{PATHELEM:executor}/runs/%`indent preformatted text by 4 spaces`{PATHELEM:run} and now logstash conf file look like this filter { grok { patterns\_dir =\> "/pattern" match =\> { "file" =\> "%{TASKPATH}" } } } but got following error when tried to start the logstash. {:timestamp=\>"2016-08-15T10:28:03.118000-0500", :message=\>"An unexpected `error occurred!", :error=\>#\, :class=\>"Grok::PatternError"} I followed this [https://docs.mesosphere.com/1.7/administration/logging/filter-elk/](https://docs.mesosphere.com/1.7/administration/logging/filter-elk/) link as guide line. Any help is highly appreciated. ---
**Author:** ![rai](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@rai](https://discuss.elastic.co/u/rai)\ **Post date:** [August 15, 2016, 3:59pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/6 "2016-08-15T15:59:02Z")
even I got the same error after providing the complete path of pattern file like patterns\_dir =\> "/etc/logstash/pattern/" Thanks Rai ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 15, 2016, 7:46pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/7 "2016-08-15T19:46:46Z")
With all the "indent preformatted text by 4 spaces" garbage it's hard to understand what the file actually looks like. Where's the definition of PATHELEM that you're using in multiple places in TASKPATH? Did you mean THELEM instead? ---
**Author:** ![rai](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@rai](https://discuss.elastic.co/u/rai)\ **Post date:** [August 15, 2016, 9:45pm UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/8 "2016-08-15T21:45:59Z")
Hi Magnu I am really sorry for formatting issue. As you mentioned before to use \ to format the text and that's what I did. **pattern file** PATHELEM [^/]+ TASKPATH ^/var/lib/mesos/slave/slaves/%{PATHELEM:agent}/frameworks/%{PATHELEM:framework}/executors/%{PATHELEM:executor}/runs/%{PATHELEM:run} **beats-input.conf file** input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } **mesosphere-filter.conf** filter { grok { patterns\_dir =\> "/etc/logstash/pattern/" match =\> { "file" =\> "%{TASKPATH}" } } } **elasticserach-out.conf** output { elasticsearch { hosts =\> ["localhost:9200"] sniffing =\> true manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } Hope it will be in formatted form. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/error-to-run-logstash/57957/9 "2017-07-06T04:43:25Z")
Closed on July 6, 2017, 4:43am UTC