# Invalid Config File

**URL:** <https://discuss.elastic.co/t/invalid-config-file/58859>\
**Category:** Logstash\
**Created:** [August 24, 2016, 7:50pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859 "2016-08-24T19:50:42Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 24, 2016, 7:50pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/1 "2016-08-24T19:50:42Z")

</div>

When I run --configtest I get the following error:

```
     Reason: Expected one of #, at line 45, column 4 after output {
      
      if [type] == "test2"
      {
      elasticsearch {
                     hosts => "localhost:9200"
                     action => "index"
                     index => "test2"
                     workers => 29
       }
       stdout {
       codec => rubydebug 
      }
     }
     ES Mapping:
  
    POST /test2
    {
    "settings" : {
               "number_of_shards" : 1
    },
    "mappings" : {
    "test2": {
                  
                 "properties" : {
                 
                  "location" : { "type": '"geo_point"},
                  "city":{"type":"string"},
                  "country":{"type":"string"}
                 }
               }
           }
       }

```

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2016, 8:09pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/2 "2016-08-24T20:09:18Z")

</div>

Please post your configuration.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 24, 2016, 8:28pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/3 "2016-08-24T20:28:43Z")

</div>

```
input {
        file {
               path => "path to file"
               type => "test2"
               start_position => "beginning"
              ignore_older => 0
              sincedb_path => "/dev/null"
       }
}

filter {
         if [type] == "test2"
         {
          csv {
                columns => [
                  "timestamp"
                   "latitude"
                    "longitude"
                   "estaddress"
                 ]
               separator => ","
             }
          }
}
output {
 if [type] == "test2"
      {
      elasticsearch {
                     hosts => "localhost:9200"
                     action => "index"
                     index => "test2"
                     workers => 29
       }
       stdout {
       codec => rubydebug 
      }
     }
     ES Mapping:

    POST /test2
    {
    "settings" : {
               "number_of_shards" : 1
    },
    "mappings" : {
    "test2": {

                 "properties" : {

                  "location" : { "type": '"geo_point"},
                  "city":{"type":"string"},
                  "country":{"type":"string"}
                 }
               }
           }
       }
}
```

---

<div class="post-metadata">

**Author:** ![GardenMWM](https://avatars.discourse-cdn.com/v4/letter/g/e47774/32.png) [@GardenMWM](https://discuss.elastic.co/u/GardenMWM)\
**Post date:** [August 24, 2016, 8:38pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/4 "2016-08-24T20:38:12Z")

</div>

It looks like your csv columns array needs to have comma's after each element, also your missing a closing brace for the output. When I add those, it tests ok.

> input {  
> file {  
> path =\> "path to file"  
> type =\> "test2"  
> start\_position =\> "beginning"  
> ignore\_older =\> 0  
> sincedb\_path =\> "/dev/null"  
> }  
> }

> filter {  
> if [type] == "test2"  
> {  
> csv {  
> columns =\> [  
> "timestamp",  
> "latitude",  
> "longitude",  
> "estaddress"  
> ]  
> separator =\> ","  
> }  
> }  
> }  
> output {  
> if [type] == "test2"  
> {  
> elasticsearch {  
> hosts =\> "localhost:9200"  
> action =\> "index"  
> index =\> "test2"  
> workers =\> 29  
> }  
> stdout {  
> codec =\> rubydebug  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 24, 2016, 8:44pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/5 "2016-08-24T20:44:26Z")

</div>

I edited the config file. I'm still having same issue. Is the ES mapping section correct?

On kibana when I try to use tile map:

The "test2" index pattern does not contain any of the following filed types: geo\_point

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 5:37am UTC](https://discuss.elastic.co/t/invalid-config-file/58859/6 "2016-08-25T05:37:53Z")

</div>

> Is the ES mapping section correct?

There's an extra single quote that doesn't belong there. Otherwise it looks okay, but your current Logstash configuration doesn't insert any geo data in the `location` field. So, make sure the mapping is correctly set and modify your Logstash filters to correctly insert the lat/lon data into the geo\_point field.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 2:10pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/7 "2016-08-25T14:10:54Z")

</div>

Ok typos are fixed but how would I modify logstash to insert the lat/long data?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 2:17pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/8 "2016-08-25T14:17:09Z")

</div>

See [https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) for a list of how a geo\_point value can be represented for Elasticsearch to recognize it as geo\_point. Use Logstash filters like mutate to make sure your `location` field (the intended geo\_point field) will be understood by ES. For example,

```nohighlight
mutate {
  add_field => {
    "location" => "%{latitude},%{longitude}"
  }
}

```

should work.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 2:25pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/9 "2016-08-25T14:25:40Z")

</div>

```
Here are the changes I made after csv {

}

if [latitude] and [longitude] {
       mutate {
                      add_field => ["[location", "%{longitude}"]
                      add_field => ["[location", "%{latitude}"]
       }
       mutate {
                      convert => ["[location]", "geo_point" ]
                      }
                      }
}

output ......

```

I am still getting expected one of # error after if [type] == "test2"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 2:31pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/10 "2016-08-25T14:31:05Z")

</div>

> ```
> add_field => [ "[location", "%{longitude}" }
> 
> ```

Change to one of the following:

```plaintext
add_field => ["location", "%{longitude}"]
add_field => { "location" => "%{longitude}" }
add_field => ["[location]", "%{longitude}" ]
add_field => { "[location]" => "%{longitude}" }

```

> ```
> convert => ["[location]", "geo_point" ]
> 
> ```

As documented, the mutate filter's convert option doesn't support the geo\_point type.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 2:41pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/11 "2016-08-25T14:41:37Z")

</div>

If I change it to

```
convert => ["[location]", "float" ]

```

I am still getting expected one of #, =\> at line 42, column 5 after filter {  
if [type] == "test2"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 4:51pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/12 "2016-08-25T16:51:38Z")

</div>

Without seeing your full configuration file I can't help.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 5:15pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/13 "2016-08-25T17:15:42Z")

</div>

```
input {
        file {
               path => "path to file"
               type => "test2"
               start_position => "beginning"
               ignore_older => 0
               sincedb_path => "/dev/null"
       }
}

filter {
         if [type] == "test2"
         {
          csv {
                  columns => [
                  "timestamp"
                   "latitude"
                    "longitude"
                   "estaddress"
                 ]
               separator => ","
             }
}

if [latitude] and [longitude] {
   mutate {
                  add_field => ["[location", "%{longitude}"]
                  add_field => ["[location", "%{latitude}"]
   }
   mutate {
                  convert => ["[location]", "float" ]
                  }
                  }
}
          }
}
output {
 if [type] == "test2"
      {
      elasticsearch {
                     hosts => "localhost:9200"
                     action => "index"
                     index => "test2"
                     workers => 29
       }
       stdout {
       codec => rubydebug 
      }
 
     }
     ES Mapping:

    POST /test2
    {
    "settings" : {
               "number_of_shards" : 1
    },
    "mappings" : {
    "test2": {

                 "properties" : {

                  "location" : { "type": '"geo_point"},
                  "city":{"type":"string"},
                  "country":{"type":"string"}
                 }
               }
           }
       }
}
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 6:07pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/14 "2016-08-25T18:07:21Z")

</div>

Wait, what? The "ES Mapping:" part is included in your Logstash configuration file? Remove it!

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 6:30pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/15 "2016-08-25T18:30:18Z")

</div>

```
input {
        file {
               path => "path to file"
               type => "test2"
               start_position => "beginning"
               ignore_older => 0
               sincedb_path => "/dev/null"
       }
}

filter {
          csv {
                  columns => [
                  "timestamp"
                   "latitude"
                    "longitude"
                   "estaddress"
                 ]
               separator => ","
             }
}

if [latitude] and [longitude] {
   mutate {
                  add_field => ["[location", "%{longitude}"]
                  add_field => ["[location", "%{latitude}"]
   }
   mutate {
                  convert => ["[location]", "float" ]
                  }
                  }
}
          }
}
output {
      elasticsearch {
                     hosts => "localhost:9200"
                     action => "index"
                     index => "test2"
                     workers => 29
       }
       stdout {
       codec => rubydebug 
      }
}

```

This configuration file works but on Kibana not mapping geo cordinates. It states "test2" index pattern does not contain geo\_point field. Where do I declare geo\_point on the config file.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 6:33pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/16 "2016-08-25T18:33:42Z")

</div>

You need to create an index template that will get applied to the indexes you'll be creating. In that template you can configure the `location` field as geo\_point. The elasticsearch output has options related to index templates.

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 6:57pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/17 "2016-08-25T18:57:48Z")

</div>

Ok I got it to run with new index.json template but still getting the no Geo\_point error

my config file:

```
input {
        file {
               path => "path to file"
               type => "test2"
               start_position => "beginning"
               ignore_older => 0
               sincedb_path => "/dev/null"
       }
}

filter {
          csv {
                  columns => [
                  "timestamp"
                   "latitude"
                    "longitude"
                   "estaddress"
                 ]
               separator => ","
             }
}

if [latitude] and [longitude] {
   mutate {
                  add_field => ["[location", "%{longitude}"]
                  add_field => ["[location", "%{latitude}"]
   }
   mutate {
                  convert => ["[location]", "float" ]
                  }
                  }
}
          }
}
output {
      elasticsearch {
                     hosts => "localhost:9200"
                     action => "index"
                     index => "test2"
                     workers => 29
                     manage _template => true
                     template => "path to template,json"
                     template_overwrite => "true"
       }
       stdout {
       codec => rubydebug 
      }
}

```

My template.json

```
{
     "template" : "test2"
     "settings" : {
                   "index.refresh_interval" : "5s"
       },
       "mappings" : {
                            "_default_" : {
                           "_all_" : { "enabled" : true, "omit_norms" : true },
                           "properties" : {
                          "@timestamp" : { "type" : "date", "doc_values" : true},
                          "location" : {
                                      "type" : "geo_point",
                                      "dynamic" : true,
                                       "properties" : {
                                       "latitude" : { "type" : "float", "doc_values" : true },
                                        "longitude: : {"type" : "float", "doc_values" : true }
                                 }
                           }
                       }
                   }
           }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 8:28pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/18 "2016-08-25T20:28:32Z")

</div>

Did you delete and recreate the test2 index after getting the index template in place?

---

<div class="post-metadata">

**Author:** ![kmk3173](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@kmk3173](https://discuss.elastic.co/u/kmk3173)\
**Post date:** [August 25, 2016, 11:32pm UTC](https://discuss.elastic.co/t/invalid-config-file/58859/19 "2016-08-25T23:32:32Z")

</div>

I don't think so. I re-ran it on cmd but is there a command line function to delete the previous index?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 26, 2016, 7:29am UTC](https://discuss.elastic.co/t/invalid-config-file/58859/20 "2016-08-26T07:29:22Z")

</div>

Yes, of course: [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html)

[Next page](https://discuss.elastic.co/t/invalid-config-file/58859.md?page=2)