Logstash Configuration Error

Elastic Stack Logstash
1

[2020-09-02T16:11:38,526][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)", :backtrace=>["C:/ELK/logstash-7.9.0/logstash-7.9.0/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in initialize'", "C:/ELK/logstash-7.9.0/logstash-7.9.0/logstash-core/lib/logstash/java_pipeline.rb:44:in initialize'", "C:/ELK/logstash-7.9.0/logstash-7.9.0/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "C:/ELK/logstash-7.9.0/logstash-7.9.0/logstash-core/lib/logstash/agent.rb:357:in block in converge_state'"]}
[2020-09-02T16:11:38,708][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-09-02T16:11:43,782][INFO ][logstash.runner ] Logstash shut down.
[2020-09-02T16:11:43,804][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

input {
file {
path => "C:\ELK\Logs"
start_position => "begining"
sincedb_path => "NULL"
}
}

filter {
grok {
match => { "message" => "^%{MONTHDAY:month}/%{MONTHDAY:day}/%{YEAR:year} %{TIME:time} %{GREEDYDATA:logmessage}"}
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
This is my conf file and it is encoded in UTF-8

2

Do not use backslash in the path option of a file input, it is interpreted as an escape. Use forward slash.

If you do not want the in-memory sincedb persisted across restarts then use "NUL" for the sincedb_path, not "NULL".

Does your configuration file have a BOM in it?

3

Got it. It was indented incorrectly. And no, it is not in BOM.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.