# Filebeat, Logstash issue **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 5, 2019, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283 "2019-09-05T15:22:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\ **Post date:** [September 5, 2019, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283/1 "2019-09-05T15:22:45Z")
Hey guys, **My environment - Dev** 1. Master nodes (Elasticsearch & Logstash are installed) x 2 2. Kibana node (Only Kibana) x 1 3. All m servers are on CentOS7 **Before you ask** 1. I can reach my master nodes 2. Both nodes see eachother 3. I can access Kibana **What I am trying to achieve** Having syslog from Elasticsearch servers sent to my ELK. _Why ?_ To understand how it works and the output from my configuration. That being said, launching logstash results in a fail so is my filebeat. * * * **Config files** _Logstash conf_ Path: /etc/logstash/conf.d/logstash-syslog.conf > input { > beats { port =\> "5044" } > } > > filter { > grok { > match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } > } > } > > } > output { > elasticsearch { > hosts =\> ["192.168.131.134:9200","192.168.131.136:9200"] > } > stdout { > codec =\> rubydebug > } > } _Pipeline conf_ > - pipeline.id: main > path.config: "/etc/logstash/conf.d/\*.conf" > > - pipeline.id: filebeat > queue.type: persisted > path.config: "/etc/logstash/conf.d/logstash-syslog.conf" _Filebeat conf_ > filebeat.prospectors: > > - input\_type: log > enabled: true > paths: > - /var/log/messages > - /var/log/\*.log > - /var/log/syslog > > setup.kibana: > host: "192.168.131.135:5601" > > output.logstash: > hosts: ["192.168.131.134:5044", "192.168.131.136:5044"] **Error facing** ``` > -- The start-up result is done. > Sep 05 11:19:48 elk-prod-1 logstash[4986]: Thread.exclusive is deprecated, use Thread::Mutex > Sep 05 11:19:52 elk-prod-1 logstash[4986]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties > Sep 05 11:19:54 elk-prod-1 logstash[4986]: [2019-09-05T11:19:54,927][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.3.1"} > Sep 05 11:19:56 elk-prod-1 logstash[4986]: [2019-09-05T11:19:56,880][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 11, column 1 (byte 125) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]} > Sep 05 11:19:56 elk-prod-1 logstash[4986]: [2019-09-05T11:19:56,875][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:filebeat, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 11, column 1 (byte 125) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]} > Sep 05 11:19:57 elk-prod-1 logstash[4986]: [2019-09-05T11:19:57,354][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} > Sep 05 11:20:02 elk-prod-1 logstash[4986]: [2019-09-05T11:20:02,066][INFO][logstash.runner] Logstash shut down. > Sep 05 11:20:02 elk-prod-1 systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE > Sep 05 11:20:02 elk-prod-1 systemd[1]: Unit logstash.service entered failed state. > Sep 05 11:20:02 elk-prod-1 systemd[1]: logstash.service failed. > Sep 05 11:20:02 elk-prod-1 systemd[1]: logstash.service holdoff time over, scheduling restart. > Sep 05 11:20:02 elk-prod-1 systemd[1]: Stopped logstash. > -- Subject: Unit logstash.service has finished shutting down > -- Defined-By: systemd > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel > -- > -- Unit logstash.service has finished shutting down. ``` ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [September 5, 2019, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283/2 "2019-09-05T15:32:18Z")
``` filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } } ``` **}** Problem seems to be here, one extra } bracket ---
**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\ **Post date:** [September 5, 2019, 3:47pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283/3 "2019-09-05T15:47:44Z")
Thanks, now I am heading to Beats. Can`t make it work haha. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 3, 2019, 3:47pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283/4 "2019-10-03T15:47:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.