# Help with logstash csv and beats conf file

**URL:** <https://discuss.elastic.co/t/help-with-logstash-csv-and-beats-conf-file/160035>\
**Category:** Logstash\
**Created:** [December 9, 2018, 9:15am UTC](https://discuss.elastic.co/t/help-with-logstash-csv-and-beats-conf-file/160035 "2018-12-09T09:15:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [December 9, 2018, 9:15am UTC](https://discuss.elastic.co/t/help-with-logstash-csv-and-beats-conf-file/160035/1 "2018-12-09T09:15:54Z")

</div>

Hi,

I have an issue with my config file - any help appreciated

`input {  
stdin {  
type =\> "stdin-type"  
}  
file {  
path =\> "/etc/logstash/data/test.csv"  
start\_position =\> beginning  
# to read from the beginning of file  
sincedb\_path =\> "/dev/null"  
}  
beats {  
type =\> "beats\_events"  
port =\> 5044  
}  
}  
filter {  
if [type] == "stdin-type"  
csv {  
separator =\> ","  
columns =\> ["Domain", "Class", "ElementName", "InstanceDisplayName", "Event", "Count", "Owner", "Ticket", "FirstNotifiedAt", "snhSource", "snhZone", "snhID", "snhDuration", "Acknowledged", "Active", "Category", "Certainty", "ClassName", "ClearOnAcknowledge", "ElementClassName", "EventName", "EventState", "EventText", "EventType", "Impact", "InMaintenance", "InstanceName", "IsProblem", "IsRoot", "LastChangedAt", "LastClearedAt", "LastNotifiedAt", "Name", "Severity", "SourceEventType", "ConsoleNotifiedAt", "ServiceLevel", "TechType", "TicketArea", "Suppression", "RootAction", "ExternalIntegration", "Priority", "Customer", "TicketStatus"]  
}  
}  
##example from CSV FirstNotifiedAt 31/03/2018 23:58:00  
filter {  
date {  
match =\> ["FirstNotifiedAt", "dd/MM/yyyy HH:mm:ss"]  
target =\> "@timestamp"  
}  
}

## Add your filters / logstash plugins configuration here

output {  
if [type] == "stdin-type"  
elasticsearch {  
hosts =\> "xxx.xxx.xxx.xxx:9200"  
manage\_template =\> false  
action =\> "index"  
index =\> "test01"  
user =\> "xxxxxxxxx"  
password =\> "xxxxxxxxxx"  
}  
stdout { codec =\> rubydebug }

}  
output {  
if [type] == "beats\_events"  
elasticsearch {  
hosts =\> "xxx.xxx.xxx.xxx:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
user =\> "xxxxxxxxx"  
password =\> "xxxxxxxxxx"  
}  
}

stdout:

[2018-12-09T08:50:43,873][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, and, or, xor, nand, **{ at line 18, column 5 (byte 326) after filter {\n if [type] == "stdin-type"\n**", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in`block in converge\_state'"]}

---

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [December 12, 2018, 8:11pm UTC](https://discuss.elastic.co/t/help-with-logstash-csv-and-beats-conf-file/160035/2 "2018-12-12T20:11:16Z")

</div>

@magnusbaeck - apologies for the tag, you have helped with a previous query...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2019, 8:11pm UTC](https://discuss.elastic.co/t/help-with-logstash-csv-and-beats-conf-file/160035/3 "2019-01-09T20:11:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.