# Logstash 7.5.0 configuration error

**URL:** <https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385>\
**Category:** Logstash\
**Created:** [December 3, 2019, 3:18pm UTC](https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385 "2019-12-03T15:18:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeffreyshoptrader](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)\
**Post date:** [December 3, 2019, 3:18pm UTC](https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385/1 "2019-12-03T15:18:42Z")

</div>

Hi I'm new to ELK and I want to connect Logstash to Elasticsearch, but my data doesn't go to Elasticsearch. Everytime I try to run Logstash I get an error.

[2019-12-03T16:14:10,102][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.5.0"}  
[2019-12-03T16:14:11,788][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "input", "filter", "output" at line 2, column 1 (byte 2) after \n", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:156:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge\_state'"]}  
[2019-12-03T16:14:12,317][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2019-12-03T16:14:17,243][INFO][logstash.runner] Logstash shut down.

This is the config file I use, I can't seem to find what is wrong.

input {  
file {  
path =\> "/var/log/customapacheacceslog"  
start\_postition =\> "beginning"  
}  
}

filter {  
mutate { replace =\> { "type" =\> "apache\_access" } }  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
date {  
match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
stdout { codec =\> rubydebug }  
}

Hope to hear from you guys!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 3, 2019, 10:42pm UTC](https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385/2 "2019-12-03T22:42:17Z")

</div>

Try running with --config.debug --log.level debug --config.test\_and\_exit on the command line. That will show you each file that it is loading as part of the configuration, and it will show you the merged configuration. You can then identify where line 2 is coming from.

---

<div class="post-metadata">

**Author:** ![Jeffreyshoptrader](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)\
**Post date:** [December 4, 2019, 8:25am UTC](https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385/4 "2019-12-04T08:25:43Z")

</div>

Hi Badger,

Thanks for the help!  
I worked, Logstash is running now! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2020, 8:25am UTC](https://discuss.elastic.co/t/logstash-7-5-0-configuration-error/210385/5 "2020-01-01T08:25:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.