# Expected one of \[A-Za-z0-9\_-\], \[\\t\\n \\n\], "#","=\>" ... after input {

**URL:** <https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694>\
**Category:** Logstash\
**Tags:** elastic-stack-alerting\
**Created:** [January 24, 2024, 8:41am UTC](https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694 "2024-01-24T08:41:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZinedineR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zinediner/32/131072_2.png) [@ZinedineR](https://discuss.elastic.co/u/ZinedineR)\
**Post date:** [January 24, 2024, 8:41am UTC](https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694/1 "2024-01-24T08:41:31Z")

</div>

The error comes in line 19 column 19 in after input{}  
I think the configuration is correct but the error shows there's unexpected character

```auto
input {
  jdbc {
   jdbc_driver_library => "$DRIVER_PATH"
   jdbc_connection_string => "$JDBC_CONNECTION_STRING"
   jdbc_user => "$JDBC_USER"
   jdbc_password => "$JDBC_PASSWORD"
   jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
   sql_log_level => "debug"
   jdbc_default_timezone => "Asia/Jakarta"
    statement => "
      DECLARE @TDate datetime;
      SET @TDate = '$SP_DATE';
      EXEC [$DB_IMSSIAR].[dbo].sp_getdatasaldoperproductperaccount @TDate;
    "
}

filter {
  mutate{
      add_field => {"id" => "%{idcustomer}%{idproduct}%{noaccount}%{date}"}
      add_field => {"id_perproduct" => "%{idcustomer}_%{idproduct}_%{noaccount}"}
   	  remove_field => ["@version"]
  }
}

output {
    stdout { codec => json_lines } 
    elasticsearch {
      index => 'sp_getdatasaldoperproductperaccount'
      doc_as_upsert => true
      action => "update"
      document_id => "%{id_perproduct}"
      ssl => true
      ssl_certificate_verification => false
      cacert => "$CERT_PATH"
      hosts => ["$ELASTIC_HOST"]
      user => '$ELASTIC_USER'
      password => '$ELASTIC_PASS'
    }
    elasticsearch {
     index => 'sp_getdatasaldoperproductperaccount_scheduler'
     ssl => true
     ssl_certificate_verification => false
     cacert => "$CERT_PATH"
     hosts => ["$ELASTIC_HOST"]
     user => '$ELASTIC_USER'
     password => '$ELASTIC_PASS'
     doc_as_upsert => true
     action => "update"
     document_id => "%{id}"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2024, 2:46pm UTC](https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694/2 "2024-01-24T14:46:03Z")

</div>

You are missing a } to close the input section, so logstash is trying to parse filter as if it were an input.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 24, 2024, 9:18pm UTC](https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694/3 "2024-01-24T21:18:42Z")

</div>

Test your .conf file with the optimal parameter: `-t` or `--config.test_and_exit` before you run it. Check [more options](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2024, 9:19pm UTC](https://discuss.elastic.co/t/expected-one-of-a-za-z0-9-t-n-n-after-input/351694/4 "2024-02-21T21:19:11Z")

</div>

Closed on February 21, 2024, 9:19pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.