Hi!!!
In my config file i have a part:
if [message] =~ /^Deauthorizing client /
{
mutate { add_tag => “end_timer” }
noop { add_field => { "event" => "deauthorize" }}
}
if [message] =~ /^Logged in/
{
mutate { add_tag => “start_timer” }
noop{ add_field => {"event" => "logged in"}}
}
all I want is ro add a tag when logs comes with message Deauthorizing client or Logged in, but when i load this config file I get a message:
Error: Expected one of #, ", ', -, [, { at line 190, column 25 (byte 4241) after filter {
if [message] =~ /^Deauthorizing client /
{
mutate { add_tag =>
You may be interested in the '--configtest' flag which you can
use to validate logstash's configuration before you choose
to restart a running system.
Can you explain me what am I doing wrong?
you can use add_field with mutate {}
If you intend to add a tag (i.e. use add_tag) then the input is an array i.e. add_tag => [ "end_timer" ]
If on the other hand you want to add a field, then you can use add_field => { "timer_status-which-is-a-new-field" => "end_timer" }
The configuration you're showing us looks okay. My first thought was that you might've stumbled upon bug #2850 but I don't think that's the case. Please show more context from your configuration. The problem might be with the lines preceding what you've shown us.
To debug problems like this if you can't spot the problem right away, remove configuration until it passes --configtest. Eventually you'll probably get down to a single culprit line.