# Logstash configuration error when using filter

**URL:** <https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013>\
**Category:** Logstash\
**Created:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013 "2018-06-07T14:18:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vkrishna91](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@vkrishna91](https://discuss.elastic.co/u/vkrishna91)\
**Post date:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013/1 "2018-06-07T14:18:25Z")

</div>

Hi,  
I have installed logstash 6.2 and with the following configuration i am not able to start the logstash. I am getting error at the filter configuration, but i tried to change it and getting the same result. Can anyone help me with this.

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}

filter {  
if [type] == "cq-access"{  
grok {  
match =\> ["message", "%{IPORHOST:clientip} - %{USER:ident} %{HTTPDATE:timestamp} %{QS}"]  
}  
date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
user =\> "logstash\_admin"  
password =\> "Logstashpassword"  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

Error:

[2018-06-07T14:10:24,390][WARN][logstash.licensechecker.licensereader] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6}

[2018-06-07T14:10:24,414][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>".monitoring-logstash", :thread=\>"#\<Thread:0x15df503e@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:247 sleep\>"}

[2018-06-07T14:10:24,432][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 10, column 8 (byte 213) after input { \n\tbeats {\n \t\tport =\> 5044\n \t\tssl =\> true\n \t\tssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"\n \t\tssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"\n \t }\t\t\t\n\nfilter {\n\t\tgrok ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'",

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 7, 2018, 3:17pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013/2 "2018-06-07T15:17:57Z")

</div>

You have a } to close the beats input, but you are missing a } to close the input section. It should be

```auto
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {

```

---

<div class="post-metadata">

**Author:** ![vkrishna91](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@vkrishna91](https://discuss.elastic.co/u/vkrishna91)\
**Post date:** [June 7, 2018, 4:25pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013/3 "2018-06-07T16:25:47Z")

</div>

thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2018, 4:26pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-when-using-filter/135013/4 "2018-07-05T16:26:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.