# Logstash Configuration Error with BlueLiv **URL:** \ **Category:** Logstash\ **Created:** [November 8, 2016, 10:37pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416 "2016-11-08T22:37:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ossec.junkie](https://avatars.discourse-cdn.com/v4/letter/o/6a8cbe/32.png) [@ossec.junkie](https://discuss.elastic.co/u/ossec.junkie)\ **Post date:** [November 8, 2016, 10:37pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416/1 "2016-11-08T22:37:30Z")
Hi there- I'm pretty new to the ELK stack and have been tasked with using ELK Stack and BlueLiv Threat Intelligence Community. I have my basic setup configured for all ELK components, they start and what not however when I attempt to use my configuration for the BlueLiv community, I get the following error in my /var/log/logstash/logstash-plain.log file, error: [2016-11-08T13:49:51,483][ERROR][logstash.agent] fetched an invalid config {:config=\>"input { \n blueliv {\n api\_url =\> "[https://freeapi.blueliv.com](https://freeapi.blueliv.com)" \n http\_timeout =\> 1000 \n api\_key =\> "KEYREMOVED"\n feeds =\> {\n "b$ My configuration follows the documentation at [https://github.com/Blueliv/](https://github.com/Blueliv/) with my .conf file configured like so: input { blueliv { api\_url =\> "[https://freeapi.blueliv.com](https://freeapi.blueliv.com)" http\_timeout =\> 1000 api\_key =\> "KEYREMOVED" feeds =\> { "botips" =\> { "active" =\> true "feed\_type" =\> "non\_pos" } "crimeservers" =\> { "active" =\> true "feed\_type" =\> "all" } } } } output { elasticsearch { hosts =\> "localhost" index =\> "blueliv-%{@collection}" manage\_template =\> false document\_id =\> "%{\_id}" } } Not really sure what the issue is, I thought maybe I had an extra } in place but I tried to match every bracket together and didn't notice any out of place. Anything you can provide to help out would be most appreciated!! I just can't seem to figure out what's the issue here. If it helps, the URL from BlueLIv to setup ELK stack is available at: [https://github.com/Blueliv/elk-config-examples/blob/master/documentation.pdf](https://github.com/Blueliv/elk-config-examples/blob/master/documentation.pdf) Just in case, I was able to install the BlueLiv plugin for LogStash, no problem. ---
**Author:** ![andrewvc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewvc/32/5064_2.png) [@andrewvc](https://discuss.elastic.co/u/andrewvc)\ **Post date:** [November 8, 2016, 10:48pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416/2 "2016-11-08T22:48:00Z")
Can you post the full error message? The one you're posting looks like it has the end cut off. Also, did you make sure to install the bluliv plugin? ---
**Author:** ![ossec.junkie](https://avatars.discourse-cdn.com/v4/letter/o/6a8cbe/32.png) [@ossec.junkie](https://discuss.elastic.co/u/ossec.junkie)\ **Post date:** [November 8, 2016, 11:15pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416/3 "2016-11-08T23:15:24Z")
Andrew, Thank you so much for replying and the help. I was able to install the blueliv plugin. My apologies for the error message being cutoff. Here is the full error message. [2016-11-08T13:51:39,908][ERROR][logstash.agent] fetched an invalid config {:config=\>"input { \n blueliv {\n api\_url =\> "[https://freeapi.blueliv.com](https://freeapi.blueliv.com)" \n http\_timeout =\> 1000 \n api\_key =\> "KEYREMOVED"\n feeds =\> {\n "botips" =\> {\n "active" =\> "true"\n "feed\_type" =\> 'non\_ pos"\n } \n "crimeservers" =\> {\n "active" =\> "true" \n "feed\_type" =\> "recent"\n }\n }\n }\n}\n\n output {\n elasticsearch {hosts =\> [" localhost"] index =\> "blueliv-%{@collection}" \nmanage\_template =\> false document\_id =\> "%{document\_id}"}}\n\ninput { blueliv { api\_url =\> "[https://freeapi.blueliv](https://freeapi.blueliv) .com" http\_timeout =\> 1000 api\_key =\> "KEYREMOVED" feeds =\> { "botips" =\> { "active" =\> true "feed\_type" =\> "non\_pos" } "crimeserve rs" =\> {"active" =\> true "feed\_type" =\> "all" }}}} \noutput { elasticsearch {hosts =\> "localhost" index =\> "blueliv-%{@collection}" manage\_template =\> false d ocument\_id =\> "%{\_id}"}\n\n", :reason=\>"Expected one of \', ', any character at line 26, column 1 (byte 867) after input { \n blueliv {\n api\_url =\> "[https://freea](https://freea) [pi.blueliv.com](http://pi.blueliv.com)" \n http\_timeout =\> 1000 \n api\_key =\> "KEYREMOVED"\n feeds =\> {\n "botips" =\> {\n "active" =\> "true"\n "feed\_type" =\> 'non\_pos"\n } \n "crimeservers" =\> {\n "active" =\> "true" \n "feed\_type" =\> "recent"\n }\n }\n }\n}\n\n output {\n elasti csearch {hosts =\> ["localhost"] index =\> "blueliv-%{@collection}" \nmanage\_template =\> false document\_id =\> "%{document\_id}"}}\n\ninput { blueliv { api\_url =\> "ht tps://freeapi.blueliv.com" http\_timeout =\> 1000 api\_key =\> "KEYREMOVED" feeds =\> { "botips" =\> { "active" =\> true "feed\_type" =\> "non \_pos" } "crimeservers" =\> {"active" =\> true "feed\_type" =\> "all" }}}} \noutput { elasticsearch {hosts =\> "localhost" index =\> "blueliv-%{@collection}" manag e\_template =\> false document\_id =\> "%{\_id}"}\n\n"} ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 9, 2016, 12:44am UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416/4 "2016-11-09T00:44:28Z")
> [@ossec.junkie](#): > > Expected one of ', ', any character at line 26, column 1 You should check that line. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2016, 12:44am UTC](https://discuss.elastic.co/t/logstash-configuration-error-with-blueliv/65416/5 "2016-12-07T00:44:44Z")
Closed on December 7, 2016, 12:44am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.