# Invalid Configuration Error
**URL:** https://discuss.elastic.co/t/invalid-configuration-error/144078
**Category:** Logstash
**Created:** [August 13, 2018, 6:35am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078 "2018-08-13T06:35:17Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 6:35am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/1 "2018-08-13T06:35:17Z")
Hi Team,
I am working on parsing apache access logs along with error logs to elastic via logstash index and facing invlaid configuration error. I am copying my filebeat input and logstash input for reference.
## Filebeat Input:
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
- type: log
enabled: true
paths:
- /home/patcat/roddock\_webservices/error\*. _._
- /home/patcat/paddock\_webservices/error\*. _._
log\_type: apache\_error
paths:
- /home/patcat/roddock\_webservices/access\*.\*
- /home/patcat/paddock\_webservices/access\*.\*
log\_type: apache\_access
exclude\_lines: ['a10hm/1.0']
## Logstash Conf file:
input {
beats {
port =\> "5068"
}
}
filter {
if [log\_type] == "apache\_error" {
grok {
match =\> { "message" =\> '[%{DATA:ApachErrortime}] [%{NOTSPACE:ApachErrorloglevel}] (?:[client %{IPORHOST:clientip}]) {0,1}%{GREEDYDATA:ApachErrorMessage}' }
}
overwrite =\> ["message"]
}
else if [log\_type] == "apache\_access" {
grok {
match =\> { "message" =\> '%{NUMBER:ResponseTime}\s%{COMBINEDAPACHELOG}\s%{GREEDYDATA:Ignore}' }
}
mutate {
rename =\> { "timestamp" =\> "Apachetimestamp" }
}
date {
match =\> ["Apachetimestamp" , "ISO8601"]
}
mutate {
convert =\> { "bytes" =\> "integer" }
}
mutate {
convert =\> { "response" =\> "integer" }
}
mutate {
convert =\> { "ResponseTime" =\> "integer" }
}
mutate {
remove\_field =\> ["Ignore" , "message"]
}
overwrite =\> ["message"]
}
}
Quick assistance is of high value. Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 6:47am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/2 "2018-08-13T06:47:23Z")
Always quote the full error message. You're not even saying if it's Logstash or Filebeat that's complaining.
> overwrite =\> ["message"]
This belongs inside a grok filter.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 7:02am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/3 "2018-08-13T07:02:08Z")
Sorry, My bad the problem occurs while executing the logstash conf file. Also tried including the overwrite within grok filter...
[2018-08-13T00:01:10,736][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of #, =\> at line 10, column 32 (byte 306) after filter {
if [log\_type] == "apache\_error" {
grok {
match =\> { "message" =\> "[%{DATA:ApachErrortime}] [%{NOTSPACE:ApachErrorloglevel}] (?:[client %{IPORHOST:clientip}] ){0,1}%{GREEDYDATA:ApachErrorMessage}" }
overwrite =\> { "message"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 8:43am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/4 "2018-08-13T08:43:56Z")
> overwrite =\> { "message"
This indicates that your configuration contains `overwrite => { "message" }` which is wrong. `overwrite => ["message"]` is correct.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 9:03am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/5 "2018-08-13T09:03:46Z")
Yes i agree, but i have done that change but still very similar issue with output section.
[2018-08-13T01:56:28,376][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of #, =\> at line 35, column 11 (byte 938) after filter {
if [log\_type] == "apache\_error" {
grok {
match =\> { "message" =\> "[%{DATA:ApachErrortime}] [%{NOTSPACE:ApachErrorloglevel}] (?:[client %{IPORHOST:clientip}] ){0,1}%{GREEDYDATA:ApachErrorMessage}" }
overwrite =\> ["message"]
}
}
else if [log\_type] == "apache\_access" {
grok {
match =\> { "message" =\> "%{NUMBER:ResponseTime}\s%{COMBINEDAPACHELOG}\s%{GREEDYDATA:Ignore}" }
overwrite =\> ["message"]
}
mutate {
rename =\> { "timestamp" =\> "Apachetimestamp" }
}
mutate {
convert =\> { "bytes" =\> "integer" }
}
mutate {
convert =\> { "response" =\> "integer" }
}
mutate {
convert =\> { "ResponseTime" =\> "integer" }
}
mutate {
remove\_field =\> ["Ignore"]
}
}
output {
stdout
[2018-08-13T01:56:28,387][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 9:47am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/6 "2018-08-13T09:47:53Z")
Looks like you're not closing the `if [log_type] == "apache_access" {` conditional.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 10:05am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/7 "2018-08-13T10:05:40Z")
Yes closing the if condition resolved it , but the overwrite filter didn't have any impact i could only see the message filed being present in the output logs.
{
"source" =\> "/home/patcat/roddock\_webservices/access\_log.20180522",
"prospector" =\> {
"type" =\> "log"
},
"message" =\> "0 10.65.19.201 - - [22/May/2018:00:08:50 -0700] "GET /assets/css/print.css HTTP/1.1" 200 509 "[https://roddoc.patqa.corp.rrk.com/profile-web/signin](https://roddoc.patqa.corp.rrk.com/profile-web/signin)" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) li
ke Gecko" GET /assets/css/print.css "-" "" "HTTP/1.1" xconnx7660 "-" "-"",
"beat" =\> {
"hostname" =\> "[xconnx7660.corp.rrk.com](http://xconnx7660.corp.rrk.com)",
"version" =\> "6.2.4",
"name" =\> "[xconnx7660.corp.rrk.com](http://xconnx7660.corp.rrk.com)"
},
"@version" =\> "1",
"tags" =\> [
[0] "beats\_input\_codec\_plain\_applied"
],
"@timestamp" =\> 2018-08-13T09:58:43.635Z,
"offset" =\> 4386,
"host" =\> "[xconnx7660.corp.rrk.com](http://xconnx7660.corp.rrk.com)"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 11:04am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/8 "2018-08-13T11:04:49Z")
None of your filters execute since the `log_type`field isn't set.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 11:09am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/9 "2018-08-13T11:09:41Z")
Yes, how do i fix it, is it the right forum or should i raise a separate request for this!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 11:14am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/10 "2018-08-13T11:14:26Z")
We can continue here. Please post your Filebeat configuration formatted as preformatted text (use the `` toolbar button or markdown notation) so we can see exactly what it looks like.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 11:34am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/11 "2018-08-13T11:34:05Z")
> [@Nithani25](#):
>
> #=========================== Filebeat prospectors =============================
>
> filebeat.prospectors:
>
> - type: log
Only apache\_access got picked up here and not apache\_errors...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 13, 2018, 12:00pm UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/12 "2018-08-13T12:00:56Z")
As I said I want to see the configuration formatted as preformatted text.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 13, 2018, 12:07pm UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/13 "2018-08-13T12:07:36Z")
```
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
- type: log
enabled: true
paths:
- /home/patcat/roddock_webservices/error*.*.*
- /home/patcat/paddock_webservices/error*.*.*
fields:
log_type: apache_error
fields_under_root: true
paths:
- /home/patcat/roddock_webservices/access*.*
- /home/patcat/paddock_webservices/access*.*
fields:
log_type: apache_access
fields_under_root: true
exclude_lines: ['a10hm/1.0']
#============================= Filebeat modules ===============================
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading
reload.enabled: false
# Period on which files under path should be checked for changes
#reload.period: 10s
#==================== Elasticsearch template setting ==========================
#setup.template.settings:
#index.number_of_shards: 3
#index.codec: best_compression
#_source.enabled: false
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["localhost:5070"]
```
Does it suffice!
Sorry didn't get your requirement earlier. Thanks.
---
### Author:  [@Nithani25](https://discuss.elastic.co/u/Nithani25)
#### Post date: [August 14, 2018, 9:16am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/14 "2018-08-14T09:16:03Z")
Hi,
I am able to resolve this problem with home work. Thank you very much Magnus...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2018, 9:16am UTC](https://discuss.elastic.co/t/invalid-configuration-error/144078/15 "2018-09-11T09:16:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.