# \[FATAL\] 2018-05-16 09:39:07.354 \[LogStash::Runner\] runner - The given configuration is invalid. Reason: Expected one of #, =\> at line 15, column 10 (byte 170) after
**URL:** https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051
**Category:** Logstash
**Created:** [May 16, 2018, 7:43am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051 "2018-05-16T07:43:03Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [May 16, 2018, 7:43am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051/1 "2018-05-16T07:43:03Z")
Hello, i've an error in my syslog pipeline but i'm unable to find it !
Can someone help me ?
Error :
[FATAL] 2018-05-16 09:39:07.354 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, =\> at line 15, column 10 (byte 170) after filter {
if [type] == "syslog"
{
grok
{
if
This is my config file :
> ```
> #### INPUT SECTION ####
> input {
> udp {
> port => 514
> type => syslog
> }
> }
>
> ```
```
#### FILTER SECTION ####
filter {
if [type] == "syslog"
{
grok
{
if [host] == "192.168.102.254"
{
match => { "message" => "<%{NUMBER:sequence}>%{NUMBER:sequence}: %{SYSLOGTIMESTAMP:Date}: %%{WORD:Facility}-%{WORD:Facility}-%{INT:Severity}-%{WORD:Mnemonic}: %{GREEDYDATA:Description}"}
}
else
{
match => { "message" => "<%{NUMBER:sequence}>%{NUMBER:sequence}: %{SYSLOGTIMESTAMP:Date}: %%{WORD:Facility}-%{INT:Severity}-%{WORD:Mnemonic}: %{GREEDYDATA:Description}"}
}
}
mutate {
remove_field => ["@index","@version","@type","type","sequence","message"]
gsub => [
"Severity", "0", "0 - Emergency",
"Severity", "1", "1 - Alert",
"Severity", "2", "2 - Critical",
"Severity", "3", "3 - Error",
"Severity", "4", "4 - Warning",
"Severity", "5", "5 - Notification",
"Severity", "6", "6 - Informational",
"Severity", "7", "7 - Debug"
]
}
if [Facility] == "LINEPROTO" {
drop {}
}
}
}
#### OUTPUT SECTION ####
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "cisco"
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@zqc0512](https://discuss.elastic.co/u/zqc0512)
#### Post date: [May 16, 2018, 8:02am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051/2 "2018-05-16T08:02:33Z")
> [@dyl](#):
>
> "Severity", "7", "7 - Debug"
> ]
> }
need add } after this.
---
### Author:  [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [May 16, 2018, 8:44am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051/3 "2018-05-16T08:44:56Z")
Why ? Open it with Notepad++, all } are ok for me
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 16, 2018, 10:08am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051/4 "2018-05-16T10:08:54Z")
You can't have conditionals inside your grok filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 13, 2018, 10:09am UTC](https://discuss.elastic.co/t/fatal-2018-05-16-09-39-07-354-logstash-runner-runner-the-given-configuration-is-invalid-reason-expected-one-of-at-line-15-column-10-byte-170-after/132051/5 "2018-06-13T10:09:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.