# Gz file input problem (terminal shows no response)

**URL:** https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472
**Category:** Logstash
**Created:** [August 31, 2016, 9:59pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472 "2016-08-31T21:59:50Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Allie\_Yang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allie_yang/32/16538_2.png) [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [August 31, 2016, 9:59pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472/1 "2016-08-31T21:59:50Z")

</div>

This might be a basic problem. I have the error code of "invalid config" when i try to parse gz file into logstash.

**Below is my config:**  
input {  
file {  
type =\> "gzip"  
path =\> "/Users/yangyan/Desktop/log\_file/s3\_logs/2014/testpurchase\_funnel.log.gz"  
start\_position =\> "beginning"  
codec =\> "gzip\_lines"  
}

filter {  
grok{  
match =\> { "message" =\> "%{SYSLOGBASE} %{GREEDYDATA:message}" }  
overwrite =\> ["message"]  
}

json {  
source =\> "message"  
}

mutate{  
rename =\> { "[purchase][source]" =\> "p\_source" }  
rename =\> { "[purchase][type\_id]" =\> "p\_typeId" }  
rename =\> { "[purchase][content\_id]" =\> "p\_contentId" }  
}

date{  
match =\> ["date", "YYYY-MM-dd HH:mm:ss", "ISO8601"]  
timezone =\> "Europe/Dublin"  
target =\> "date"  
}

prune {  
whitelist\_names =\> ["@timestamp", "app\_id", "member\_id", "locale", "date", "p\_source", "p\_typeId", "p\_contentId"]  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

**AND below is the error:**  
**etched an invalid config** {:config=\>"input {\n file {\n type =\> "gzip"\n path =\> "/Users/yangyan/Desktop/log\_file/s3\_logs/2014/testpurchase\_funnel.log.gz"\n start\_position =\> "beginning"\n codec =\> "gzip\_lines"\n} \n\n filter {\n grok{\n match =\> { "message" =\> "%{SYSLOGBASE} %{GREEDYDATA:message}" }\n overwrite =\> ["message"]\n}\n\n json {\n source =\> "message"\n}\n\n mutate{\n rename =\> { "[purchase][source]" =\> "p\_source" }\n rename =\> { "[purchase][type\_id]" =\> "p\_typeId" }\n rename =\> { "[purchase][content\_id]" =\> "p\_contentId" } \n}\n\n date{\n match =\> ["date", "YYYY-MM-dd HH:mm:ss", "ISO8601"]\n timezone =\> "Europe/Dublin" \n target =\> "date"\n}\n\n\n prune {\n whitelist\_names =\> ["@timestamp", "app\_id", "member\_id", "locale", "date", "p\_source", "p\_typeId", "p\_contentId"]\n} \n}\n\noutput {\n stdout { codec =\> rubydebug }\n}\n\n", :reason=\>"Expected one of #, =\> at line 10, column 9 (byte 207) after input {\n file {\n type =\> "gzip"\n path =\> "/Users/yangyan/Desktop/log\_file/s3\_logs/2014/testpurchase\_funnel.log.gz"\n start\_position =\> "beginning"\n codec =\> "gzip\_lines"\n} \n\n filter {\n grok", :level=\>:error}

---

<div class="post-metadata">

### Author: ![BenOsborne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benosborne/32/5686_2.png) [@BenOsborne](https://discuss.elastic.co/u/BenOsborne)
#### Post date: [August 31, 2016, 10:01pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472/2 "2016-08-31T22:01:28Z")

</div>

Hi @Allie_Yang,

This forum is for the Elastic Cloud service. Could you move your question to the Logstash forum.

Cheers,  
Ben

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 1, 2016, 5:42am UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472/3 "2016-09-01T05:42:25Z")

</div>

You're not closing your `input` block before you're opening your `filter` block. If you indent your configuration file consistently things like this becomes very easy to spot.

---

<div class="post-metadata">

### Author: ![Allie\_Yang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allie_yang/32/16538_2.png) [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [September 1, 2016, 7:00pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472/4 "2016-09-01T19:00:39Z")

</div>

Hey thanks i noticed that too. Now, I don't have any error. It is now showing **no response** when i begin to parse:

**My config:**  
input {  
file {  
path =\> "/Users/yangyan/Desktop/log\_file/s3\_logs/2014/01/28/event\_log/test.log.gz"  
start\_position =\> "beginning"  
codec =\> "gzip\_lines"  
type =\> "gzip"  
ignore\_older =\> 0  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
grok{  
match =\> { "message" =\> "%{SYSLOGBASE} %{GREEDYDATA:message}" }  
overwrite =\> ["message"]  
}

json {  
source =\> "message"  
}

mutate{  
rename =\> { "[purchase][source]" =\> "p\_source" }  
rename =\> { "[purchase][type\_id]" =\> "p\_typeId" }  
rename =\> { "[purchase][content\_id]" =\> "p\_contentId" }  
}

date{  
match =\> ["date", "YYYY-MM-dd HH:mm:ss", "ISO8601"]  
timezone =\> "UTC"  
target =\> "date"  
}

prune {  
whitelist\_names =\> ["@timestamp", "app\_id", "member\_id", "locale", "date", "p\_source", "p\_typeId", "p\_contentId"]  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

**My terminal response:**  
yangyan-osx:2.3.4 yangyan$ bin/logstash -f testgzip.conf  
Settings: Default pipeline workers: 8  
Pipeline main started

(nothing shows up)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2016, 7:00pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472/5 "2016-09-04T19:00:39Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.
