Failing to load conf file

Elastic Stack Logstash
1

Hey all,

First time poster. I have been struggling for over a week to get the below conf file to compile. I have read through the forums and it always seems to be missing a } however that does not seem to be the case here. I have removed my config information with **.

It appears to be getting hung up on the codec, any thoughts or suggestions? Thanks in advance.

[ERROR] 2021-11-22 13:42:35.925 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash:: ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "{", "}" at line 6, column 13 (byte 179) after input {\n\ts3 {\n\t\tbucket => "S3://***/AWSLogs”\n\t\t access_key_id => “”\n\t\tsecret_access_key => “”\n\t\tcodec => "", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/ compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize'", "/usr/s hare/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logsta sh/logstash-core/lib/logstash/agent.rb:391:in block in converge_state'"]}

Conf file
input {
s3 {
bucket => "S3://”
access_key_id => “”
secret_access_key => “******”
codec => "json"
region => “eu-west-1”
}
}

output {
microsoft-logstash-output-azure-loganalytics {
workspace_id => “*******”
workspace_key => “********"
custom_log_table_name => "AWSGuardDuty"
plugin_flush_interval => 5
}
}

2

Can you repost these sections as code? It will make it easier to read.

3

I would first try removing the codec and restarting logstash.

Then figure out what you need to do with the codec section if your data isn't being parsed correctly.

4

Your issue is here, line 6 of your config:

Can you edit your question and share your full config as a code, using the pre-formatted text?

Also, check all your double quotes to see if for some reason you do not have a diferent double quote, this can happens if you are using some text editors and copying and pasting the config.

For example, in the config you shared you have this case, your double quotes should be the ones like on the codec setting, not the ones on the region setting`.

codec => "json"
region => “eu-west-1”
5

Thanks so much, I think that got me to the next error!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.