# Logstash conf

**URL:** <https://discuss.elastic.co/t/logstash-conf/228972>\
**Category:** Logstash\
**Created:** [April 21, 2020, 6:26am UTC](https://discuss.elastic.co/t/logstash-conf/228972 "2020-04-21T06:26:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cheruku125](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@Cheruku125](https://discuss.elastic.co/u/Cheruku125)\
**Post date:** [April 21, 2020, 6:26am UTC](https://discuss.elastic.co/t/logstash-conf/228972/1 "2020-04-21T06:26:14Z")

</div>

Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 8, column 97 (byte 388) after input {\n jdbc {\n jdbc\_driver\_library =\> "/home/elkadmin/Desktop/spdatabase/jdbc.jar"\n jdbc\_driver\_class =\> "com.mysql.jdbc.Driver"\n jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/identityiq?zeroDateTimeBehavior=convertToNull"\n jdbc\_user =\>"root"\n jdbc\_password =\> ""\n statement =\> "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key="", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge\_state'"]}  
[2020-04-21T11:42:56,632][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2020-04-21T11:43:01,132][INFO][logstash.runner] Logstash shut down.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 21, 2020, 6:44am UTC](https://discuss.elastic.co/t/logstash-conf/228972/2 "2020-04-21T06:44:51Z")

</div>

Are you asking for help here?

---

<div class="post-metadata">

**Author:** ![Cheruku125](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@Cheruku125](https://discuss.elastic.co/u/Cheruku125)\
**Post date:** [April 21, 2020, 8:36am UTC](https://discuss.elastic.co/t/logstash-conf/228972/3 "2020-04-21T08:36:27Z")

</div>

Yeah. Anything wrong with the syntax?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 21, 2020, 3:27pm UTC](https://discuss.elastic.co/t/logstash-conf/228972/4 "2020-04-21T15:27:16Z")

</div>

> [@Cheruku125](#):
>
> statement =\> "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key=""

If you have double quotes in the value of @key they need to be escaped. What does the statement option look like in your configuration?

---

<div class="post-metadata">

**Author:** ![Cheruku125](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@Cheruku125](https://discuss.elastic.co/u/Cheruku125)\
**Post date:** [April 22, 2020, 2:53am UTC](https://discuss.elastic.co/t/logstash-conf/228972/5 "2020-04-22T02:53:12Z")

</div>

Here is the statement I've written in the logfile:

statement =\> "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key="CITY"]/@value')) as Regions from spt\_identity"

When I executed this query in phpmyadmin it was working fine. But while creating an index it is showing the error mentioned above.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 22, 2020, 3:36pm UTC](https://discuss.elastic.co/t/logstash-conf/228972/6 "2020-04-22T15:36:53Z")

</div>

> [@Cheruku125](#):
>
> statement =\> "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key="CITY"]/@value')) as Regions from spt\_identity"

You need to escape the double quotes withing the statement.

```
statement => "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key=\"CITY\"]/@value')) as Regions from spt_identity"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2020, 3:37pm UTC](https://discuss.elastic.co/t/logstash-conf/228972/7 "2020-05-20T15:37:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.