# Input / Filter problems with 6.3.2

**URL:** <https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721>\
**Category:** Logstash\
**Created:** [August 2, 2018, 8:56am UTC](https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721 "2018-08-02T08:56:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanielE](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@DanielE](https://discuss.elastic.co/u/DanielE)\
**Post date:** [August 2, 2018, 8:56am UTC](https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721/1 "2018-08-02T08:56:26Z")

</div>

Hi,

i´m having a problem with my new 6.3.2 stack. I am using three different conf files for Input, filter and ouput. At the Moment i can´t add a field in my Input to start using my filter. Also my experiements to use tags as a filter option didn´t work.

Input.conf

```
input {
  syslog {
      port => 5000
      syslog_field => "syslog"
      grok_pattern => "<%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} CUSTOM GROK HERE"
      tags => "syslog"
  }
  add_field => {
      origin => "syslog"
  }
}

```

filter.conf

```
filter {
  if [tags] == "syslog" {
      grok {
         match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
         add_field => ["received_at", "%{@timestamp}"]
         add_field => ["received_from", "%{host}"]
      }
      date {
         match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
      }
      mutate {
         add_field => {
            retention => "medium"
         }
      }
  }
}

```

Output.conf

```
output {
    elasticsearch {
            index => "logstash-%{retention}-%{+YYYY.MM.dd}"
        }
    }

```

Logstash Error

[2018-08-02T10:50:25,917][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Expected one of #, { at line 26, column 13 (byte 749) after input {\n syslog {\n port =\> 5000\n syslog\_field =\> "syslog"\n grok\_pattern =\> "\<%{POSINT:priority}\>%{SYSLOGTIMESTAMP:timestamp} CUSTOM GROK HERE"\n tags =\> "syslog"\n }\n add\_field ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/reload.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in`block in converge\_state'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 2, 2018, 9:18am UTC](https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721/2 "2018-08-02T09:18:58Z")

</div>

The `add_field` option in your input block needs to go inside the syslog input (rather than be nested directly under "input").

---

<div class="post-metadata">

**Author:** ![DanielE](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@DanielE](https://discuss.elastic.co/u/DanielE)\
**Post date:** [August 2, 2018, 9:23am UTC](https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721/3 "2018-08-02T09:23:55Z")

</div>

Thank you Magnus, it now works!

I needed to put origin in double quotes. The final input looks like this:

```
input {
  syslog {
      port => 5000
      syslog_field => "syslog"
      tags => "syslog"
      add_field => {
          "origin" => "syslog"
      }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2018, 9:24am UTC](https://discuss.elastic.co/t/input-filter-problems-with-6-3-2/142721/4 "2018-08-30T09:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.