# I got this error when i did sudo service logstash configtest

**URL:** <https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069>\
**Category:** Logstash\
**Created:** [March 27, 2017, 5:35am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069 "2017-03-27T05:35:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [March 27, 2017, 5:35am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069/1 "2017-03-27T05:35:09Z")

</div>

Error: Expected one of #, if, ", ', } at line 49, column 2 (byte 1331) after filter  
{  
{:level=\>:error}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 27, 2017, 5:44am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069/2 "2017-03-27T05:44:19Z")

</div>

It's impossible to help without seeing your configuration.

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [March 27, 2017, 5:55am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069/3 "2017-03-27T05:55:35Z")

</div>

These are the conf file i have

01-lumberjack-input.conf

input {  
lumberjack {  
port =\> 5044  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

02-beats-input.conf

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

10-syslog.conf

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

10-syslog-filter.conf

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

11-nginx.conf

filter {  
if [type] == "nginx-access" {  
grok {  
match =\> { "message" =\> "%{NGINXACCESS}" }  
}  
}  
}

11-nginx-filter.conf

filter  
{  
[type] == "nginx-access" {  
grok {  
geoip {  
source =\> "localhost"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}

```
  match => { "message" => "%{NGINXACCESS}" }
}

```

}  
}

30-elasticsearch-output.conf  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
document\_id =\> "%{fingerprint}"  
}  
}

30-lumberjack-output.conf

output {  
elasticsearch { host =\> localhost }  
stdout { codec =\> rubydebug }  
}

30-output-stdout.conf

output {  
stdout { codec =\> json }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 27, 2017, 6:03am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069/4 "2017-03-27T06:03:30Z")

</div>

Have a look at your 11-nginx-filter.conf. It looks like you've pasted a geoip and a mutate filter in the middle of your grok filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2017, 6:03am UTC](https://discuss.elastic.co/t/i-got-this-error-when-i-did-sudo-service-logstash-configtest/80069/5 "2017-04-24T06:03:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.