# Load config file into logstash

**URL:** <https://discuss.elastic.co/t/load-config-file-into-logstash/24915>\
**Category:** Logstash\
**Created:** [July 5, 2015, 7:37pm UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915 "2015-07-05T19:37:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Post date:** [July 5, 2015, 7:37pm UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/1 "2015-07-05T19:37:38Z")

</div>

Hi!!!  
In my config file i have a part:  
if [message] =~ /^Deauthorizing client /  
{  
mutate { add\_tag =\> “end\_timer” }  
noop { add\_field =\> { "event" =\> "deauthorize" }}  
}  
if [message] =~ /^Logged in/  
{  
mutate { add\_tag =\> “start\_timer” }  
noop{ add\_field =\> {"event" =\> "logged in"}}  
}  
all I want is ro add a tag when logs comes with message Deauthorizing client or Logged in, but when i load this config file I get a message:  
Error: Expected one of #, ", ', -, [, { at line 190, column 25 (byte 4241) after filter {  
if [message] =~ /^Deauthorizing client /  
{  
mutate { add\_tag =\>  
You may be interested in the '--configtest' flag which you can  
use to validate logstash's configuration before you choose  
to restart a running system.  
Can you explain me what am I doing wrong?

---

<div class="post-metadata">

**Author:** ![wstlk](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@wstlk](https://discuss.elastic.co/u/wstlk)\
**Post date:** [July 6, 2015, 3:56am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/2 "2015-07-06T03:56:21Z")

</div>

you can use add\_field with mutate {}

---

<div class="post-metadata">

**Author:** ![yuphing](https://avatars.discourse-cdn.com/v4/letter/y/7ea924/32.png) [@yuphing](https://discuss.elastic.co/u/yuphing)\
**Post date:** [July 6, 2015, 4:21am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/3 "2015-07-06T04:21:43Z")

</div>

If you intend to add a tag (i.e. use add\_tag) then the input is an array i.e. add\_tag =\> ["end\_timer"]

If on the other hand you want to add a field, then you can use add\_field =\> { "timer\_status-which-is-a-new-field" =\> "end\_timer" }

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2015, 5:37am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/4 "2015-07-06T05:37:41Z")

</div>

The configuration you're showing us looks okay. My first thought was that you might've stumbled upon [bug #2850](https://github.com/elastic/logstash/issues/2850) but I don't think that's the case. Please show more context from your configuration. The problem might be with the lines preceding what you've shown us.

To debug problems like this if you can't spot the problem right away, remove configuration until it passes `--configtest`. Eventually you'll probably get down to a single culprit line.

---

<div class="post-metadata">

**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Post date:** [July 6, 2015, 5:53am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/5 "2015-07-06T05:53:21Z")

</div>

@magnusbaeck  
Everything is ok, I have wrong quotes in my add\_tag. Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915/6 "2017-07-06T05:35:32Z")

</div>