Logstash config error reason=>"Expected one of #, \", ', }

Elastic Stack Logstash
1

Why this error is coming...
input {
file {
path => [ "Documents/apache-sample-dataset.log" ]
type => "apache"
start_position => "beginning"
}
}

filter {
if [type] == "apache" {
grok {
match => ["message", "%{COMBINEDAPACHELOG}"]
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
geoip {
source => "clientip"
target => "geoip"
database => "Documents/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
}
}

output {
elasticsearch {
host => localhost
}
}

1 Like
2

What line is it reporting on?

3

at line 3, column 1 (byte 20) after input \t{\n \tfile\t{\n

4

I can't see the root of your problem, but one thing that has helped me immensely in troubleshooting a config file is to comment out everything but the first step, and then "build" the config back up from there, doing the --configtest thing every step. So you could start with
input {
file {
path => [ "Documents/apache-sample-dataset.log" ]
type => "apache"
start_position => "beginning"
}
}

#filter {
#if [type] == "apache" {
#grok {
#match => ["message", "%{COMBINEDAPACHELOG}"]
#}
#}
#date {
#match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
#}
#geoip {
#source => "clientip"
#target => "geoip"
#database => "Documents/GeoLiteCity.dat"
#add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
#add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
#}
#mutate {
#convert => [ "[geoip][coordinates]", "float" ]
#}
#}

#output {
#elasticsearch {
#host => localhost
#}
#}

and add on from there

1 Like
5

You need to use a full path for this file, I think. Windows or Linux?

1 Like
6

Thank you. It is now working.

7

Im Using mac im unable to configure apache log.
im getting error
" Error: Expected one of #, ", ', -, [, {, ] at line 4, column 14 (byte 33) after input { file { path => [

i tried
path => "/Users/tcstsb3/Downloads/log/access_log.log"

path => ["/user....../apache.log"]

path => ["user....../apache.log"]

same error only im getting,

ANY ONE PLZ HELP ME

input {

file {
path => [“/Users/tcstsb3/Downloads/log/access_log”]
type => "apache"
}

}

filter {

grok {
  match => { “message” => “%{COMBINEDAPACHELOG}” }
}

}

output {
elasticsearch {
hosts => [“10.145.40.24:9200”]
}
stdout { codec => rubydebug }
}

9

Please start your own thread.