# Inserting several grok filters in one logstash conf file
**URL:** https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497
**Category:** Logstash
**Created:** [May 3, 2019, 8:30am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497 "2019-05-03T08:30:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@gerardo\_aliberti](https://discuss.elastic.co/u/gerardo_aliberti)
#### Post date: [May 3, 2019, 8:30am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497/1 "2019-05-03T08:30:55Z")
Hello guys,
I'm having an error when adding a grok filter to my logstash config:
[FATAL] 2019-05-03 09:53:36.256 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, {, ,, ] at line 7, column 17 (byte 140) after filter {
I've tried to count every "{" in the file, but it doesn't look like there is any missing. Are you somehow able to help me identify the issue?
This is my file for the check:
filter {
grok {
overwrite =\> ["log"]
break\_on\_match =\> true
remove\_field =\> ["log"]
match =\> [
"log","{"log":"{\"v\":\"%{GREEDYDATA:v}\",\"category\":\"%{GREEDYDATA:category}\",\"level\":\"%{GREEDYDATA:level}\",\"timestamp\":\"%{GREEDYDATA:timestamp}\",\"application\":{\"name\":\"%{GREEDYDATA:name}\",\"version\":\"%{GREEDYDATA:version}\",\"component\":\"%{GREEDYDATA:component}\",\"thread\":\"%{GREEDYDATA:thread}\",\"instanceId\":\"%{GREEDYDATA:instanceId}\",\"process\":\"%{GREEDYDATA:process}\"},\"context\":{\"sessionId\":\"%{GREEDYDATA:sessionId}\",\"tenantId\":\"%{GREEDYDATA:tenantId}\",\"principalId\":\"%{GREEDYDATA:principalId}\",\"ext\":{\"CorrelationId\":\"%{GREEDYDATA:CorrelationId}\",\"x-ol-channel\":\"%{GREEDYDATA:x-ol-channel}\",\"x-ol-correlation-id\":\"%{GREEDYDATA:x-ol-correlation-id}\",\"jti\":\"%{GREEDYDATA:jti}\",\"scenarioName\":\"%{GREEDYDATA:scenarioName}\",\"scenarioId\":\"%{GREEDYDATA:scenarioId}\",\"connector\":\"%{GREEDYDATA:connector}\",\"taskId\":\"%{GREEDYDATA:taskId}\"}},\"details\":{\"type\":\"%{GREEDYDATA:type}\",\"description\":\"%{GREEDYDATA:description}\",\"details\":{\"billing\":\"%{GREEDYDATA:billing}\",\"status\":\"%{GREEDYDATA:status}\"}}}\n","stream":%{GREEDYDATA:stream},"time":"%{GREEDYDATA:time}"}",
"log","%{GREEDYDATA:message}"
]
}
}
Thanks in advance,
Gerardo
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [May 3, 2019, 10:14am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497/2 "2019-05-03T10:14:51Z")
[match](https://www.elastic.co/guide/en/logstash/7.0/plugins-filters-grok.html#plugins-filters-grok-match) is expecting a _hash_ not an _array_.
So `match` is expecting a `{` instead of a `[` after `=>`
---
### Author:  [@gerardo\_aliberti](https://discuss.elastic.co/u/gerardo_aliberti)
#### Post date: [May 3, 2019, 10:33am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497/3 "2019-05-03T10:33:20Z")
Hi,
thanks for the reply. How should i then rewrite the filter?
I mean, just by replacing the brackets with the { doesn't solve the issue...
BR
Gerardo
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [May 3, 2019, 10:45am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497/4 "2019-05-03T10:45:10Z")
That grok pattern is a bit hard to follow but something like this
```
grok {
match => { "log" => (("{\"v\":\"%{GREEDYDATA:v}\",\"category\":\"%{GREEDYDATA:category}\",\"level\":\"%{GREEDYDATA:level}\",\"timestamp\":\"%{GREEDYDATA:timestamp}\",\"application\":{\"name\":\"%{GREEDYDATA:name}\",\"version\":\"%{GREEDYDATA:version}\",\"component\":\"%{GREEDYDATA:component}\",\"thread\":\"%{GREEDYDATA:thread}\",\"instanceId\":\"%{GREEDYDATA:instanceId}\",\"process\":\"%{GREEDYDATA:process}\"},\"context\":{\"sessionId\":\"%{GREEDYDATA:sessionId}\",\"tenantId\":\"%{GREEDYDATA:tenantId}\",\"principalId\":\"%{GREEDYDATA:principalId}\",\"ext\":{\"CorrelationId\":\"%{GREEDYDATA:CorrelationId}\",\"x-ol-channel\":\"%{GREEDYDATA:x-ol-channel}\",\"x-ol-correlation-id\":\"%{GREEDYDATA:x-ol-correlation-id}\",\"jti\":\"%{GREEDYDATA:jti}\",\"scenarioName\":\"%{GREEDYDATA:scenarioName}\",\"scenarioId\":\"%{GREEDYDATA:scenarioId}\",\"connector\":\"%{GREEDYDATA:connector}\",\"taskId\":\"%{GREEDYDATA:taskId}\"}},\"details\":{\"type\":\"%{GREEDYDATA:type}\",\"description\":\"%{GREEDYDATA:description}\",\"details\":{\"billing\":\"%{GREEDYDATA:billing}\",\"status\":\"%{GREEDYDATA:status}\"}}}\n","stream":%{GREEDYDATA:stream},"time":"%{GREEDYDATA:time}")|%{GREEDYDATA:message}")}
remove_field => ["log"]
break_on_match => true
}
```
In your config above you are also both overwriting and removing the field `log`. I chose to just remove it in my example...
I assumed you wanted to try to match the `log` field to either the "complex" pattern or put everything in `message` so I put the "complex" pattern inside () and added an or (the pipe) so that if the "complex" pattern is not a match, everything is put in `message`.
I did not test this and I did not check you complex pattern for syntax errors. There is a lot going on...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2019, 10:45am UTC](https://discuss.elastic.co/t/inserting-several-grok-filters-in-one-logstash-conf-file/179497/5 "2019-05-31T10:45:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.