Grok - ConfigurationError", :message=>"Expected one of #, {, ,, ]

Elastic Stack Logstash
1

Hello,
I tried to figure out why I get below error but I do not see what could be wrong in my logstash config file. Hopefully someone can help. I did check message patter in "Grok Debugger" and it works there. Any ideas why it does not run?

Example input data:

1520428168091,513,Request,200,OK,test 1-4,text,true,,1037,376,20,20,513,0,442

Logstash pipeline config file:

input {
    tcp {
		port => 5000
	}
    file {
                path => ["/usr/share/logstash/pipeline/reports/*.csv"]
    }
}

filter {
    grok {
        match => { "message" => "(%{NUMBER:timestamp})?,(%{NUMBER:elapsed})?,(?<label>[^,;]+)?,(%{INT:responseCode})?,(%{WORD:responseMessage})?,(?<threadName>[^,;]+)?,(%{WORD:dataType})?,(%{WORD:result})?,(?<failureMessage>[^,;]+)?,(%{NUMBER:bytes})?,(%{NUMBER:sentBytes})?,(%{NUMBER:grpThreads})?,(%{NUMBER:allThreads})?,(%{NUMBER:latency})?,(%{NUMBER:idleTime})?,(%{NUMBER:connect})?"}
    }

}
output {
elasticsearch {
hosts => "elasticsearch:9200"
user => myuser
password => mypass
index => "logstash-jmeter-%{+YYYY.MM.dd}"
}
}

Error in console:

logstash_1 | [2018-03-26T13:45:04,725][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 12, column 30 (byte 166) after filter {\n grok {\n match => [ "message" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in block in converge_state'", "org/jruby/RubyArray.java:1734:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:inblock in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:inconverge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:inblock in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.