# Logstash cannot start because of Config Error - can't find the issue
**URL:** https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575
**Category:** Logstash
**Created:** [May 14, 2020, 7:47am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575 "2020-05-14T07:47:19Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [May 14, 2020, 7:47am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/1 "2020-05-14T07:47:20Z")
So i've reconfigured my logstash-config files - to seperate different logs.
Now if i try to start it - i get the following error:
> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main,
> :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of
> [\t\r\n], "#", "input", "filter", "output" at line 9, column 1 (byte 56) after ",
I tried to spot an error in my config - but i cannot see one - here's the config file:
```
input {
udp {
port => 5140
type => syslog
}
}
filter {
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
if [message] =~ /devname=/ {
kv {
source => "message"
}
mutate {
convert => { "cpu" => "integer" }
convert => { "mem" => "integer" }
convert => { "disk" => "integer" }
convert => { "totalsession" => "integer" }
rename => { "type" => "fgt_type" }
rename => { "subtype" => "fgt_subtype" }
add_field => ["type", "syslog"]
add_field => ["fortilog", 1]
lowercase => ["vd"]
}
}
}
output {
if [type] == "syslog" {
elasticsearch {
hosts => ["X.X.X.X"]
index => "Network"
user => User
password => ********
cacert => '/etc/logstash/certs/ca.crt'
ssl_certificate_verification => false
}
}
}
```
Can somebody point out my failure? Thanks in advance!
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 14, 2020, 9:11am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/2 "2020-05-14T09:11:43Z")
i tested your config with config test and it works fine (no syntax error). are you sure you're pasting right config? your error
> [@Moritz\_Kiesewetter](#):
>
> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main,
> :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of
> [\t\r\n], "#", "input", "filter", "output" at line 9, column 1 (byte 56) after ",
indicated syntax error on line 9 of the config. however your line 9 seems to have correct syntax
---
### Author:  [@ropc](https://discuss.elastic.co/u/ropc)
#### Post date: [May 14, 2020, 9:14am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/3 "2020-05-14T09:14:44Z")
Hi @Moritz_Kiesewetter - Which version of Logstash are you using? which OS?
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [May 14, 2020, 9:15am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/4 "2020-05-14T09:15:21Z")
Hi,
sorry i forgot to mention it!
I use Logstash v.7.6 on a CentOS 7.
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [May 14, 2020, 9:37am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/6 "2020-05-14T09:37:06Z")
Ok i'm really sorry! I did some trial and error - and found out the faulty config is another one is the same directory :
Faulty Conf:
```
input {
udp {
port => 5140
type => syslog
}
}
if [message] =~ /-esx-/ {
if [message] =~ /^\S+ \S+ \S+ \S+: \S+ \S+ \[Originator@\d+ [^]]+\] .*$/
{
grok {
match => ["message", "\S+ \S+ (?\S+) (?\S+): (?\S+) (?\S+) \[Originator@\d+ (?[^]]+)\] (?.*)" ]
}
kv {
source=>"esxsubinfo"
}
}
else {
grok {
match => ["message", "^\S+ \S+ (?\S+) (?\S+): (?.*)$"]
}
}
}
output {
elasticsearch {
hosts => ["X.X.X.X:9200"]
index => "VmWare"
#index => "VmWare-%{+YYYY.MM.dd}"
user => USER
password => *****
cacert => '/etc/logstash/certs/ca.crt'
ssl_certificate_verification => false
}
}
```
If i test the conf - it says there is an error :
> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "input", "filter", "output" at line 7, column 1 (byte 54) after ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:47:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:55:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:17:in `block in compile_sources'", "org/jruby/RubyArray.java:2580:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:14:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge\_state'"]}
I checked it with the old conf - but cannot find the issue
---
### Author:  [@ropc](https://discuss.elastic.co/u/ropc)
#### Post date: [May 14, 2020, 9:39am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/7 "2020-05-14T09:39:45Z")
@Moritz_Kiesewetter - `filter` keyword is missing 🙂
---
### Author:  [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)
#### Post date: [May 14, 2020, 9:42am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/8 "2020-05-14T09:42:53Z")
I see - added it 🙂 Now it works! Thanks a lot.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2020, 9:42am UTC](https://discuss.elastic.co/t/logstash-cannot-start-because-of-config-error-cant-find-the-issue/232575/9 "2020-06-11T09:42:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.