How to identify the errors reported by logstash?

[wajika]

I can't understand where is the error?
Who can share how to quickly identify the specific location of the error?

input {
  elasticsearch {
	hosts => ["192.168.10.141:9200"]
	index => "apm-*-error-*"
	query => '{ "query": 
	      { 
	          "range": { 
			        "@timestamp": { 
					       "gte": "2020-11-03T05:38:22.537Z",
						   "lte": "2021-11-03T05:38:22.537Z",
						   "format": "strict_date_optional_time"
					}
				}
		  }
	  }'
	scroll => "1m"
	size => "1000"
  }
}

[ERROR] 2021-11-03 06:02:06.156 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", [A-Za-z0-9_-], '"', "'", [A-Za-z_], "-", [0-9], "[", "{" at line 26, column 12 (byte 444) after output {\n file {\n path => ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in block in converge_state'"]}

I put the query statement in dev tools to execute, it is no problem.

[wajika]

/usr/share/logstash/bin/logstash -e 'input { elasticsearch { hosts => {{ 192.168.10.141:9200 }} index => "apm--error-" query => '{"query": { "range": { "@timestamp": { "gte": "2020-11-03T05:38:22.537Z","lte": "2021-11-03T05:38:22.537Z", "format": "strict_date_optional_time" } } } }' scroll => "5m" size => "1000" user => "XXXX" password => "XXXX" } } output { file { path => "./output.csv" fields => ["@timestamp","trace.id", "service.name","http.request.body.original" } }'

I run it through the command line and it also shows an unknown error.

ERROR: Unknown command '{'

[Badger]

@wajika

LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", [A-Za-z0-9_-], '"', "'", [A-Za-z_], "-", [0-9], "[", "{" at line 26, column 12 (byte 444) after output {\n file {\n path => "

What does your output section look like? Whatever your path setting is, logstash does not like it. Do you have curly quotes around the path? If so, change them to regular double quotes.

[wajika]

According to you, is the focus of attention after the "after output" statement?

[Badger]

The error message

Expected one of ... at line 26, column 12 (byte 444) after output {\n file {\n path => "

tells you that when the configuration compiler reached the character after output {\n file {\n path => it detected a problem. Sometimes this is due to a problem earlier in the configuration (a missing close quote, for example) and sometimes it is due to whatever comes next.

[wajika]

You are right, I want to know a quick way to find the wrong place.
I noticed Expected one of ..... at line ,column ...., but I didn't immediately think that the error was there.