# Logstash config error Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"{\\", \\",\\", \\"\]\\" at line 10, column 83
**URL:** https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619
**Category:** Logstash
**Created:** [November 7, 2020, 3:09pm UTC](https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619 "2020-11-07T15:09:06Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Tejas\_Bhosale](https://discuss.elastic.co/u/Tejas_Bhosale)
#### Post date: [November 7, 2020, 3:09pm UTC](https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619/1 "2020-11-07T15:09:06Z")
Hello,
I am using Logstash to ingest nginx into ElasticSearch. I am using a Linux Machine but i am getting error when try to start logstatsh service
elk logstash[1233]: [2020-11-07T20:25:03,741][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "{", ",", "]" at line 10, column 83 (byte 183) after filter {\n grok {\n match =\> ["message" , "%{IPV4:remote\_addr} - - \[%{HTTPDATE:log\_timestamp}\] "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge\_state'"]}
This is pipeline for logstash nginx
`
input {
beats {
port =\> 5400
host =\> "_._._._"
}
}
filter {
grok {
match =\> ["message" , "%{IPV4:remote\_addr} - - [%{HTTPDATE:log\_timestamp}] "%{HOST:http\_host}" "%{WORD:request\_method} %{DATA:uri} HTTP/1.1" %{NUMBER:response} (?:%{NUMBER:bytes}|-) "-" %{QS:agent} "%{IP:clientip}" %{NUMBER:upstream\_connect\_time} %{NUMBER:upstream\_header\_time} %{NUMBER:upstream\_response\_time} %{NUMBER:request\_time}" ]
overwrite =\> ["message"]
}
mutate {
convert =\> ["response", "integer"]
convert =\> ["bytes", "integer"]
convert =\> ["responsetime", "float"]
rename =\> ["agent", "filebeat\_agent"]
}
geoip {
source =\> "clientip"
add\_tag =\> ["nginx-geoip"]
}
date {
match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
remove\_field =\> ["timestamp"]
}
useragent {
source =\> "agent"
}
}
output {
elasticsearch {
hosts =\> ["_._._._:9200"]
index =\> "weblogs-%{+YYYY.MM.dd}"
document\_type =\> "nginx\_logs"
}
stdout { codec =\> rubydebug }
}
`
Any help will be appreciate
That grok pattern i tested on grok debugger tool website with nginx log pattern
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 7, 2020, 3:46pm UTC](https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619/2 "2020-11-07T15:46:42Z")
If you have double quotes in your pattern you need to either escape them with backslash or surround the string with single quotes.
```
match => ["message" , '%{IPV4:remote_addr} - - [%{HTTPDATE:log_timestamp}] "%{HOST:http_host}" "%{WORD:request_method} %{DATA:uri} HTTP/1.1" %{NUMBER:response} (?:%{NUMBER:bytes}|-) "-" %{QS:agent} "%{IP:clientip}" %{NUMBER:upstream_connect_time} %{NUMBER:upstream_header_time} %{NUMBER:upstream_response_time} %{NUMBER:request_time}' ]
```
---
### Author:  [@Tejas\_Bhosale](https://discuss.elastic.co/u/Tejas_Bhosale)
#### Post date: [November 9, 2020, 7:39am UTC](https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619/3 "2020-11-09T07:39:52Z")
Thanks it worked and fixed my issue ..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2020, 7:39am UTC](https://discuss.elastic.co/t/logstash-config-error-expected-one-of-t-r-n-at-line-10-column-83/254619/4 "2020-12-07T07:39:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.