Logstash basic setup not working

Elastic Stack Logstash
1

Hi Team ,

I have installed logstash and tried to use filters to get the logs which are present locally to print. But it is not working. I get below error can you please check and help me. Please find below logstash config file

input {
file {
path => "/tmp/server/server1.logs"
start_position => "beginning"
}
}

filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
stdout { codec => rubydebug }
}

when I try to print I get below error message

opt/logstash/bin/logstash -f test1.conf
Error: Expected one of #, if, ", ', } at line 2, column 1 (byte 9) after input {
{:level=>:error}

is something wrong which I am doing. can you please suggest.

2

Do you have some kind of garbage character at the beginning of the file? If I copy/paste what you've posted into a file and feed it to Logstash starts up just fine for me.

3

@Magnusbaeck thank you. I just created a new file it is not showing error. But when I try to print output on commandline I see below

[root@deheremap7075 conf.d]# /opt/logstash/bin/logstash -f test1.conf
Settings: Default pipeline workers: 2
Logstash startup completed

Why can't I see output display in command line? Is something wrong?

4

It's probably tailing the file and waiting for more input. Please read about sincedb, sincedb_path, and ignore_older in the documentation and in the archives of this site.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.