Expected one of [A-Za-z0-9_-], [\t\n \n], "#","=>" ... after input {

Elastic Stack Logstash
1

The error comes in line 19 column 19 in after input{}
I think the configuration is correct but the error shows there's unexpected character

input {
  jdbc {
   jdbc_driver_library => "$DRIVER_PATH"
   jdbc_connection_string => "$JDBC_CONNECTION_STRING"
   jdbc_user => "$JDBC_USER"
   jdbc_password => "$JDBC_PASSWORD"
   jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
   sql_log_level => "debug"
   jdbc_default_timezone => "Asia/Jakarta"
    statement => "
      DECLARE @TDate datetime;
      SET @TDate = '$SP_DATE';
      EXEC [$DB_IMSSIAR].[dbo].sp_getdatasaldoperproductperaccount @TDate;
    "
}

filter {
  mutate{
      add_field => {"id" => "%{idcustomer}%{idproduct}%{noaccount}%{date}"}
      add_field => {"id_perproduct" => "%{idcustomer}_%{idproduct}_%{noaccount}"}
   	  remove_field => ["@version"]
  }
}

output {
    stdout { codec => json_lines } 
    elasticsearch {
      index => 'sp_getdatasaldoperproductperaccount'
      doc_as_upsert => true
      action => "update"
      document_id => "%{id_perproduct}"
      ssl => true
      ssl_certificate_verification => false
      cacert => "$CERT_PATH"
      hosts => ["$ELASTIC_HOST"]
      user => '$ELASTIC_USER'
      password => '$ELASTIC_PASS'
    }
    elasticsearch {
     index => 'sp_getdatasaldoperproductperaccount_scheduler'
     ssl => true
     ssl_certificate_verification => false
     cacert => "$CERT_PATH"
     hosts => ["$ELASTIC_HOST"]
     user => '$ELASTIC_USER'
     password => '$ELASTIC_PASS'
     doc_as_upsert => true
     action => "update"
     document_id => "%{id}"
    }
}
2

You are missing a } to close the input section, so logstash is trying to parse filter as if it were an input.

2 Likes
3

Test your .conf file with the optimal parameter: -t or --config.test_and_exit before you run it. Check more options.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.