# HELP WITH LOGSTASH PLUGIN **URL:** \ **Category:** Logstash\ **Created:** [April 23, 2020, 10:35am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438 "2020-04-23T10:35:18Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 10:35am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/1 "2020-04-23T10:35:18Z")
I am trying to analyze whatsapp chats on elastic, but my logstash config file seem to be the problem this is my config file input { beats { type =\> "whatsapp-alerts" port =\> 5012 } } filter { if [type]=="whatsapp-alerts" { grok{ break\_on\_match =\> false named\_captures\_only =\> true match =\> ["message" , "\s\*%{NOTSPACE:logdate},\s\*%{GREEDYDATA}-%{SPACE}\s\*%{GREEDYDATA:PhoneNumber}:\s\*%{GREEDYDATA:Message}"] } date { match =\> ["logdate", "ISO8601" , "M/d/yy"] target =\> "logdate" } mutate { add\_field =\> { "indexType" =\> "WHATSAPP-LOG" } } } if {"indexType" =\> "WHATSAPP-LOG"} } output { elasticsearch { hosts =\> "[http://localhost:9200](http://localhost:9200)" index =\> "whatsapp-logs-%{+YYYY.MM.dd}" document\_type =\> doc user =\> "indent" password =\> "changeme" } error message: ][INFO][org.reflections.Reflections] Reflections took 205 ms to scan 1 urls, producing 20 keys and 40 values [2020-04-23T11:23:32,058][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=\>#\, :path=\>"logstash/filters/if", :type=\>"filter", :name=\>"if"} [2020-04-23T11:23:32,090][FATAL][logstash.runner] The given configuration is invalid. Reason: Unable to configure plugins: (PluginLoadingError) Couldn't find any filter plugin named 'if'. Are you sure this is correct? Trying to load the if filter plugin resulted in this error: no such file to load -- logstash/filters/if [2020-04-23T11:23:32,138][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 23, 2020, 10:57am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/2 "2020-04-23T10:57:01Z")
You have curly braces surrounding your second conditional. ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 10:58am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/3 "2020-04-23T10:58:49Z")
Thank you so much for replying. please i am very new to this. i dont understand the terms yet. what second conditional please? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 23, 2020, 11:03am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/4 "2020-04-23T11:03:31Z")
Look at the second if statement and compare to the first. ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 11:13am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/5 "2020-04-23T11:13:14Z")
okay. i understand now, let me effect the changes and get back to you. thank you so much ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 11:20am UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/6 "2020-04-23T11:20:41Z")
Corrected it. this is the error am getting [elastic@elkD1 logstash-7.6.2]$ bin/logstash --config.test\_and\_exit -f /home/elastic/logstash-7.6.2/config/logstash-whatsapp.conf Sending Logstash logs to /home/elastic/logstash-7.6.2/logs which is now configured via log4j2.properties [2020-04-23T12:14:59,151][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2020-04-23T12:15:03,257][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "and", "or", "xor", "nand", "{" at line 25, column 32 (byte 645) after filter { if [type]=="whatsapp-alerts" { grok{ break\_on\_match =\> false named\_captures\_only =\> true match =\> ["message" , "\s\*%{NOTSPACE:logdate},\s\*%{GREEDYDATA}-%{SPACE}\s\*%{GREEDYDATA:PhoneNumber}:\s\*%{GREEDYDATA:Message}"] } date { match =\> ["logdate", "ISO8601" , "M/d/yy"] target =\> "logdate" } mutate { add\_field =\> { "indexType" =\> "WHATSAPP-LOG" } } } if [indexType]== "WHATSAPP-LOG" [2020-04-23T12:15:03,318][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 2:10pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/7 "2020-04-23T14:10:37Z")
it is still not working, please help ---
**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\ **Post date:** [April 23, 2020, 2:28pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/8 "2020-04-23T14:28:20Z")
@J-JENNY Below is how your filter block needs to look like. You have to supply what you want to do in the second if conditional as Christian pointed out. ``` filter { if [type] == "whatsapp-alerts" { grok{ break_on_match => false named_captures_only => true match => ["message" , "\s*%{NOTSPACE:logdate},\s*%{GREEDYDATA}-%{SPACE}\s*%{GREEDYDATA:PhoneNumber}:\s*%{GREEDYDATA:Message}"] } date { match => ["logdate", "ISO8601" , "M/d/yy"] target => "logdate" } mutate { add_field => { "indexType" => "WHATSAPP-LOG" } } } if [indexType] == "WHATSAPP-LOG" { # you have to supply what you want to do here. } } ``` ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 2:47pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/9 "2020-04-23T14:47:22Z")
Alright thank you so much for the reply. i will effect the corrections now. please is it also possible you suggest what i can input under the second condition? i am very new to this, just following a guide to analyze whatsapp chat with ELK. i do not really know what to input there. thank you for your help ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 3:59pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/10 "2020-04-23T15:59:06Z")
this is the current error. am beyond stuck now ][logstash.runner] The given configuration is invalid. Reason: Expected one of [A-Za-z0-9\_-], [\t\r\n], "#", "=\>" at line 28, column 17 (byte 583) after filter { if [type] == "whatsapp-alerts" { grok{ break\_on\_match =\> false named\_captures\_only =\> true match =\> ["message" , "\s\*%{NOTSPACE:logdate},\s\*%{GREEDYDATA}-%{SPACE}\s\*%{GREEDYDATA:PhoneNumber}:\s\*%{GREEDYDATA:Message}"] } date { match =\> ["logdate", "ISO8601" , "M/d/yy"] target =\> "logdate" } mutate { add\_field =\> { "indexType" =\> "WHATSAPP-LOG" } } } output { elasticsearch [2020-04-23T16:52:35,696][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 4:01pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/11 "2020-04-23T16:01:10Z")
this is the output section output { elasticsearch{ hosts =\> "localhost:5044" index =\> "%{whatsapp-logs}-%{+YYYY.MM.dd}" document\_type =\> doc user =\> "indent" password =\> "changeme" } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 23, 2020, 4:11pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/12 "2020-04-23T16:11:55Z")
> [@J-JENNY](#): > > ``` > filter { > if [type] == "whatsapp-alerts" { > grok{ break_on_match => false named_captures_only => true match => ["message" , "\s*%{NOTSPACE:logdate},\s*%{GREEDYDATA}-%{SPACE}\s*%{GREEDYDATA:PhoneNumber}:\s*%{GREEDYDATA:Message}"] } > date { match => ["logdate", "ISO8601" , "M/d/yy"] target => "logdate" } > mutate { add_field => { "indexType" => "WHATSAPP-LOG" } } > } > output { > > ``` You are missing the } to close the filter section. ---
**Author:** ![J-JENNY](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@J-JENNY](https://discuss.elastic.co/u/J-JENNY)\ **Post date:** [April 23, 2020, 4:22pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/13 "2020-04-23T16:22:49Z")
oh my goodness. thank you so so much @Badger. this finally solved the problem. i have been on this for a long time. i cant believe that was the simple solution. its really not easy being a newbie. wow! thanks also thanks everyone @Rahul_Kumar4 @Christian_Dahlqvist. your solution also helped for the earlier issues ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2020, 4:23pm UTC](https://discuss.elastic.co/t/help-with-logstash-plugin/229438/14 "2020-05-21T16:23:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.