Log Stash config error

Elastic Stack Logstash
1

Good day,
I'm trying to load a logstash config with multiple grok filters and it gives me an error when I run a config test

.\logstash.bat : io/console not supported; tty will not be manipulated
At line:1 char:1

  • .\logstash.bat -f .\logstasg.conf -t
  •   + CategoryInfo          : NotSpecified: (io/console not ... be manipulated:String) [], RemoteException
  + FullyQualifiedErrorId : NativeCommandError

{:timestamp=>"2016-09-21T08:59:10.007000-0400", :message=>"The given configuration is invalid. Reason: Expected one of #, => at line 11, column 6 (byte 6
8) after filter {\n grok {\n if ", :level=>:fatal}

2

This is my conf file: any help will be extremely appreciated.

input {

beats {

port => 5044

}
}

filter {
grok {
if [event_id] == 4743 {
grok {
match => { "message" =>" (?#4625)(?[\w|\s]+.)\n\nSubject:\n\sSecurity\sID:\s+(?<subject_security_id>.+)\n\s+Account\sName:\s+(?<account_name>.+)\n\s+Account\sDomain:\s+(?<account_domain>\w+)\n\s+Logon\sID:\s+(?<logon_id>.+)\n\nLogon\sType:\s+(?<logon_type>\d+)\n\nAccount\sFor\sWhich\sLogon\sFailed:\n\s+Security\sID:\s+(.+)\n\s+Account\sName:\s+(?<logon_failure_account_name>.+)\n\s+Account\sDomain:\s+(?<logon_failure_account_domain>\w+)\n\nFailure\sInformation:\n\s+Failure\sReason:\s+(?<failure_reason>.+)\n\s+Status:\s+(?<failure_status>.+)
}
}
}
if [event_id] == 4740 {
grok {
match => { "message" =>" (?#4740)(?[\w|\s]+.)\n\nSubject:\n\sSecurity\sID:\s+(.+)\n\s+Account\sName:\s+(?<account_name>.+)\n\s+Account\sDomain:\s+(?<account_domain>\w+)\n\s+Logon\sID:\s+(?<logon_id>.+)\n\nAccount\sThat\sWas\sLocked Out:\n\s+Security\sID:\s+(.+)\n\s+Account\sName:\s+(?<locked_account_name>.+)\n\nAdditional\sInformation:\n\s+Caller\sComputer\sName:\s+(?<caller_computer_name>.+)" }
}
}
}
if [event_id] == 4743 {
grok {
match => { "message" => " (?#4743)(?[\w|\s]+.)\n\nSubject:\n\s*Security\sID:\s+(?<subject_security_id>[^\s]+)\n\s+Account\sName:\s+(?<account_name>\w+)\n\s+Account\sDomain:\s+(?<account_domain>\w+)\n\s+Logon\sID:\s+(?<logon_id>.+)\n\nTarget\sComputer:\n\s+Security\sID:\s+(?<target_security_id>[^\s]+)\n\s+Account\sName:\s+(?<target_account_name>.+)\n\s+Account\sDomain:\s+(?<target_account_domain>.+)" }
}
}
}
}

output {
elasticsearch {
hosts => ["192.168.10.80:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

3

Please move your post to the Logstash category since it has nothing to do with logstash-forwarder.

It looks like there's no closing double quote for the first grok expression.

4

how would that look?

5

What? There's no double quote at the end of your first grok expression. I don't know how to explain that in another way.

6

you missed a " at the end of your first match.
you also have too many {
Check all your opening and closing brackets, you have too many of them