# Grok - ConfigurationError", :message=\>"Expected one of #, {, ,, \]

**URL:** <https://discuss.elastic.co/t/grok-configurationerror-message-expected-one-of/125624>\
**Category:** Logstash\
**Created:** [March 26, 2018, 2:06pm UTC](https://discuss.elastic.co/t/grok-configurationerror-message-expected-one-of/125624 "2018-03-26T14:06:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrFrost](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@MrFrost](https://discuss.elastic.co/u/MrFrost)\
**Post date:** [March 26, 2018, 2:06pm UTC](https://discuss.elastic.co/t/grok-configurationerror-message-expected-one-of/125624/1 "2018-03-26T14:06:04Z")

</div>

Hello,  
I tried to figure out why I get below error but I do not see what could be wrong in my logstash config file. Hopefully someone can help. I did check message patter in "Grok Debugger" and it works there. Any ideas why it does not run?

Example input data:

`1520428168091,513,Request,200,OK,test 1-4,text,true,,1037,376,20,20,513,0,442`

Logstash pipeline config file:

```
input {
    tcp {
		port => 5000
	}
    file {
                path => ["/usr/share/logstash/pipeline/reports/*.csv"]
    }
}

filter {
    grok {
        match => { "message" => "(%{NUMBER:timestamp})?,(%{NUMBER:elapsed})?,(?<label>[^,;]+)?,(%{INT:responseCode})?,(%{WORD:responseMessage})?,(?<threadName>[^,;]+)?,(%{WORD:dataType})?,(%{WORD:result})?,(?<failureMessage>[^,;]+)?,(%{NUMBER:bytes})?,(%{NUMBER:sentBytes})?,(%{NUMBER:grpThreads})?,(%{NUMBER:allThreads})?,(%{NUMBER:latency})?,(%{NUMBER:idleTime})?,(%{NUMBER:connect})?"}
    }

```

}   
output {  
elasticsearch {  
hosts =\> "elasticsearch:9200"  
user =\> myuser  
password =\> mypass  
index =\> "logstash-jmeter-%{+YYYY.MM.dd}"  
}  
}

Error in console:

logstash\_1 | [2018-03-26T13:45:04,725][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 12, column 30 (byte 166) after filter {\n grok {\n match =\> ["message" ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2018, 2:55am UTC](https://discuss.elastic.co/t/grok-configurationerror-message-expected-one-of/125624/3 "2018-04-24T02:55:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.