# Logstash.conf not found for after installing logstash

**URL:** <https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004>\
**Category:** Logstash\
**Created:** [January 25, 2018, 8:56am UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004 "2018-01-25T08:56:36Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 29, 2018, 10:14am UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/23 "2018-01-29T10:14:34Z")

</div>

Hi, there's no such logstash.conf included on binary files. You need to create it.

```auto
input {
 #Input here 
}
output {
  #Output here
}

```

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 29, 2018, 10:20am UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/24 "2018-01-29T10:20:04Z")

</div>

Hi,

Go to /usr/share/logstash/bin  
from there, you can execute your command

```auto
 ./logstash -f /path/to/your/config/file/YourConfigFileName.conf --path.settings /path/to/your/logstash-yml --config.reload.automatic

```

---

<div class="post-metadata">

**Author:** ![SawyerFord](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@SawyerFord](https://discuss.elastic.co/u/SawyerFord)\
**Post date:** [January 29, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/25 "2018-01-29T12:00:40Z")

</div>

Thanks got problem solved...

But again I am getting the below error. I am trying to avoid the '\n\t' which I see inside the stacktrace and messages of the JSON output. I configured with the below configuration, but it throws below error

```
input { 
    stdin {
   } 
  } 
 filter {
   mutate {
   strip => "message"
 }
}
output 
    { 
      stdout {
      } 
   }

```

I get the below error message

```
    sawyer@ford11:/usr/share/logstash/bin$ ./logstash -f /etc/logstash/conf.d/logstash.conf
    WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or 
    /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
    Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using 
    default config which logs errors to the console[ERROR] 2018-01-29 15:48:08.734 [Ruby-0-Thread-
     1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - 
    Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, 
   :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output 
   at line 1, column 1 (byte 1) after ", :backtrace=>["/usr/share/logstash/logstash-
  core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-
  core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-
  core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in 
 `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", 
   "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", 
  "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:171:in `initialize'", 
 "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", 
 "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in `block in converge_state'", 
 "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", 
 "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in `block in converge_state'", 
 "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-
  core/lib/logstash/agent.rb:319:in `converge_state'", "/usr/share/logstash/logstash-
 core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", 
"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", 
"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", 
"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", 
"/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in `block in execute'", 
"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in  
 initialize'"]}
```

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [January 29, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/26 "2018-01-29T14:12:17Z")

</div>

Please change your config output to

```auto
output {
          stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![SawyerFord](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@SawyerFord](https://discuss.elastic.co/u/SawyerFord)\
**Post date:** [January 29, 2018, 8:51pm UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/27 "2018-01-29T20:51:37Z")

</div>

Again when I apply \n\t to the input as below I see Hi '\n\t inside the message. How do I get output without \n\t

```
 The stdin plugin is now waiting for input: Hi\n\t
 {
    "@timestamp" => 2018-01-29T20:45:02.759Z,
    "@version" => "1",
    "message" => "Hi\\n\\t",
    "host" => "algo-11"
 }

```

I have used the below config provided at the link  
[https://www.elastic.co/guide/en/logstash/current/multiline.html](https://www.elastic.co/guide/en/logstash/current/multiline.html)

```
 input {
 stdin {
  codec => multiline {
  pattern => "^\s"
  what => "previous"
      }
   }  
}
output { 
  stdout { codec => rubydebug } 
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2018, 8:51pm UTC](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004/28 "2018-02-26T20:51:45Z")

</div>

Closed on February 26, 2018, 8:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-conf-not-found-for-after-installing-logstash/117004.md?page=1)