Error When loading Logstash

Elastic Stack Logstash
1

Hi All,
Am getting the following error with Logstash

Blockquote
[2018-01-16T11:32:17,216][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}
[2018-01-16T11:33:13,338][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}
[2018-01-16T11:34:37,748][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}
[2018-01-16T11:35:41,704][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}
[2018-01-16T11:36:43,606][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}
[2018-01-16T11:38:09,067][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, input, filter, output at line 75, column 1 (byte 1274) after "}

Following is my Logstash config file.

Blockquote
input {
udp {
port => 12345
codec => netflow {
versions => [5,9,10]
}
type => netflow
}
udp {
port => 4739
codec => netflow {
versions => [10]
target => ipfix
}
type => ipfix
}
tcp {
port => 4739
codec => netflow {
versions => [10]
target => ipfix
}
type => ipfix
}
}
filter {
translate {
field => "host"
destination => "hostname"
dictionary => ["203.143.1.85", "Dialog", "203.143.4.1", "LISPAIX", "203.143.1.82", "Airtel", "203.143.1.22", "SLT"]
}
translate {
field => "[netflow][l4_dst_port]"
destination => "app_cat"
dictionary_path => "/etc/logstash/app_category.yml" }
translate {
field => "[netflow][l4_src_port]"
destination => "app_cat"
dictionary_path => "/etc/logstash/app_category.yml" }
translate {
field => "[netflow][ipv4_dst_addr]"
destination => "app_cat"
dictionary_path => "/etc/logstash/appips.yml"
override => "true" }
translate {
field => "[netflow][ipv4_src_addr]"
destination => "app_cat"
dictionary_path => "/etc/logstash/appips.yml"
override => "true"
}
}
output {
elasticsearch { hosts => ["127.0.0.1:9200"] }
}

2

Remove first line or comment it with #:

#Blockquote
3

Thanks for the reply!!!

Can you please specify exactly which line I have to comment......

4

The first line.

It's stated Blockqute, but's in default config it has a # before that.
I've comment it in my previous post, as an example.

5

Ahh!!!!
That's the line added from this reply box when I used the BlockQuote like below.

Blockquote

6

I've tried to run it on my test environment, but I get refused because I don't have dictionary files.

Try to removing/commenting items/filters/rows, until you get a working one and continue from there.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.