hi every one i need your help please :
i want parse a log file with grok filter but it doesn't work i don't know why :
the log file :
Aug 24 14:26:49 192.168.0.61 firewall 514865 11:12:13:14:15:16
the logstash config :
input {
file {
path => "C:\elk\logstash\file.log"
start_position => "beginning"
sincedb_path => "nul"
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:date} %{IP:ip} %{WORD:service} %{NUMBER:numero}" }
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "firstlog"
}
stdout {}
}
what i get :
C:\elk\logstash\bin>logstash -f firslog.conf
Sending Logstash's logs to C:/elk/logstash/logs which is now configured via log4j2.properties
[2018-05-17T16:53:45,702][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"C:/elk/logstash/modules/fb_apache/configuration"}
[2018-05-17T16:53:45,743][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"C:/elk/logstash/modules/netflow/configuration"}
[2018-05-17T16:53:46,654][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-05-17T16:53:49,183][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.2.3"}
[2018-05-17T16:53:51,043][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2018-05-17T16:53:53,655][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 13, column 18 (byte 267) after filter {\n grok {\n match => { "message" => "%{SYSLOGTIMESTAMP:date} %{IP:ip} %{WORD:service} %{NUMBER:numero}" }\n}\noutput {\n elasticsearch ", :backtrace=>["C:/elk/logstash/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "C:/elk/logstash/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "C:/elk/logstash/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "C:/elk/logstash/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "C:/elk/logstash/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'", "C:/elk/logstash/logstash-core/lib/logstash/pipeline.rb:169:in initialize'", "C:/elk/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:315:in block in converge_state'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:312:in block in converge_state'", "org/jruby/RubyArray.java:1734:ineach'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:299:in converge_state'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:166:inblock in converge_state_and_update'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:164:inconverge_state_and_update'", "C:/elk/logstash/logstash-core/lib/logstash/agent.rb:90:in execute'", "C:/elk/logstash/logstash-core/lib/logstash/runner.rb:348:inblock in execute'", "C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}