Just starting - Advanced Pipeline tutorial issue

Elastic Stack Logstash
1

I am using Redhat 5 with an installation of Logstash 2.3.1 (since it appears 2.3.2 does not have the plugins and I could not figure out how to get those installed) and I am trying to work through the Advanced Pipeline tutorial found here: https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html

But when I run the configtest, I get the following:

The given configuration is invalid. Reason: Expected one of #, => at line 12, column 8 (byte 330) after #The # character at the beginning of a line indicates a comment. Use

comments to describe your configuration.

input {
file {
path => "/var/log/logstash-tutorial.log"
start_position => beginning
ignore_older => 0
}

The filter part of this file is commented out to indicate that it is

optional.

filter {
grok {:level=>:fatal}

I'm just using the same configuration as what is on the tutorial and the same apache log file provided to test with. How do I go about correcting this? Not sure where to go to fix it. Please advise. Thank you.

2

Can you provide the entire config as in the file, make sure you format with the </> button so it is easy to read.

3

Here it is.

#The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
  file {
    path => "logstash-tutorial.log"
    start_position => beginning
    ignore_older => 0
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
}
output {
  stdout { }
}
4

It needs to be;

input {
  file {
    path => "logstash-tutorial.log"
    start_position => beginning
    ignore_older => 0
  }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
}
output {
  stdout { }
}

You were missing another }.

1 Like
5

Thank you - that was it (at least for that part). Now if I can only get the rest of the tutorial to work like it supposed to....