# Logstash configtest error

**URL:** <https://discuss.elastic.co/t/logstash-configtest-error/54547>\
**Category:** Logstash\
**Created:** [July 1, 2016, 2:56pm UTC](https://discuss.elastic.co/t/logstash-configtest-error/54547 "2016-07-01T14:56:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dogelorde](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@dogelorde](https://discuss.elastic.co/u/dogelorde)\
**Post date:** [July 1, 2016, 2:56pm UTC](https://discuss.elastic.co/t/logstash-configtest-error/54547/1 "2016-07-01T14:56:03Z")

</div>

Running an ELK Stack on Ubuntu Server 16 - Logstash 2.2.4 service is active, so it seems to load fine. When I run "sudo service logstash configtest", my output is this:  
Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after {:level=\>:error}

**02-file-input.conf**  
input {  
file {  
path =\> ["var/log/syslog.log"]  
type =\> "syslog"  
}  
}  
**10-syslog-filter.conf**  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}  
**30-elasticsearch-output.conf**  
output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

I'm thinking this is why I can't create a logstash index in Kibana (Unable to fetch mapping. Do you have any indices matching the pattern?)

---

<div class="post-metadata">

**Author:** ![dogelorde](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@dogelorde](https://discuss.elastic.co/u/dogelorde)\
**Post date:** [July 1, 2016, 4:51pm UTC](https://discuss.elastic.co/t/logstash-configtest-error/54547/2 "2016-07-01T16:51:57Z")

</div>

Solved this by combining all config files into one file "syslog-elasticsearch.conf" and placing it in /etc/logstash/conf.d/syslog-elasticsearch.conf

Now when I run service logstash configtest, I get configuration OK. Kibana was able to create an index pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-configtest-error/54547/3 "2017-07-06T04:49:52Z")

</div>