# Expected one of \\"\\\\\\\\'\\", any character, \\"'\\"
**URL:** https://discuss.elastic.co/t/expected-one-of-any-character/221249
**Category:** Logstash
**Created:** [February 27, 2020, 1:49pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249 "2020-02-27T13:49:07Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)
#### Post date: [February 27, 2020, 1:49pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/1 "2020-02-27T13:49:07Z")
hello elastic community i need your help, i got this error when i have add the function rename on mutate
this is the full logs error :
[ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of "\\'", any character, "'" at line 42, column 1 (byte 1168) after input {\n udp {\n host =\> '_._._._'\n port =\> 1514\n type =\> '_'\n }\n tcp {\n host =\> '_._._._'\n port =\> 1514\n type =\> 'relpsos\n }\n}\n\noutput{\n elasticsearch{\n hosts =\> ["https://_:9200","https://_:9200","https://_:9200"]\n manage\_template =\> false\n index =\> "\*"\n document\_type =\> "%{[@metadata][type]}"\n cacert =\> "/etc/logstash/certs/ca.crt"\n user =\> ""\n password =\> ""\n }\n stdout{\n codec =\> rubydebug\n }\n}\n\nfilter {\n if[type]=="soslog"{\n grok {\n match =\> { "message" =\> "time=%{DATA:timestamp}\|action=%{WORD:action}\|orig=%{IPORHOST:origin}\|i\/f\_dir=%{WORD:direction}\|i\/f\_name=%{WORD:interface}\|has\_accounting=%{INT:accounting}\|uuid=%{DATA:uuid}\|product=%{DATA:product}\|rule=%{INT:rule}\|rule\_uid=%{DATA:rule\_uid}\|\*src=%{IP:src\_ip}\|s\_port=%{INT:src\_port}\|dst=%{IP:dst\_ip}\|service=%{INT:dst\_port}\|proto=%{WORD:protocol}" }\n add\_field =\> ["received\_at", "%{@timestamp}"]\n add\_field =\> ["received\_from", "%{host}"]\n } mutate {\n convert =\> ["source.ip", "integer"]\n rename =\> ["action", "event.action"]\n }\n kv {}\n }\n}\n", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:156:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge\_state'"]}
and this is the filter :
filter {
if[type]=="\*"{
grok {
match =\> { "message" =\> "time=%{DATA:timestamp}|action=%{WORD:action}|orig=%{IPORHOST:origin}|i/f\_dir=%{WORD:direction}|i/f\_name=%{WORD:interface}|has\_accounting=%{INT:accounting}|uuid=%{DATA:uuid}|product=%{DATA:product}|rule=%{INT:rule}|rule\_uid=%{DATA:rule\_uid}|\*src=%{IP:src\_ip}|s\_port=%{INT:src\_port}|dst=%{IP:dst\_ip}|service=%{INT:dst\_port}|proto=%{WORD:protocol}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
} mutate {
convert =\> ["source.ip", "integer"]
rename =\> ["action", "event.action"]
}
kv {}
}
}
i have changed sensitive data with the symbol \*
---
### Author:  [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [February 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/2 "2020-02-27T13:56:23Z")
Hi
Looking at your log, the culprit could be `kv{}`. Try commenting it out and see what you get.
I'm not sure about your `mutate{}` starting on the same line where you close the `grok{}` filter. But that might be just here, since you didn't format your code when pasting it to your post.
There's no space between your `if` and `[type]`. That might be wrong too.
Hope this helps.
---
### Author:  [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)
#### Post date: [February 27, 2020, 2:00pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/3 "2020-02-27T14:00:25Z")
i have tried to delete the kv{} and to replace the mutate and also to make space between if and [type] but i got the same error wich is one the title
---
### Author:  [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [February 27, 2020, 2:07pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/4 "2020-02-27T14:07:46Z")
Hi
Your `convert` and `rename` might be wrong. They should be `convert => {}` and `rename => {}`. Check the syntax here: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)
Hope this helps
---
### Author:  [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)
#### Post date: [February 27, 2020, 2:15pm UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/5 "2020-02-27T14:15:21Z")
i tried the synthax on the link but i got the same problem too , i just wan't to precise that the convert function on mutate worked before adding the rename function
---
### Author:  [@ITIC](https://discuss.elastic.co/u/ITIC)
#### Post date: [February 28, 2020, 7:12am UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/6 "2020-02-28T07:12:11Z")
Hi
I suggest you remove the `rename` line, without changing anything else, and see if it still works. If it does, you can be sure the problem is in that line, and you have to center your efforts there.
Try changing `event.action` to , say, `event_action` and see what happens. Of course, make sure you have a field called `action` in the first place.
If this doesn't help then, please, comment out your entire filter section, leave only a `stdout{}` plugin in your `output{}` section. Run it once and post the complete code and output here. Something like this:
```auto
input {
}
#filter {
#
#}
output {
stdout {}
}
```
Try to use proper formatting when posting to make our lives easier.
Hope this helps.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2020, 7:12am UTC](https://discuss.elastic.co/t/expected-one-of-any-character/221249/7 "2020-03-27T07:12:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.