# Logstash Configuration Error

**URL:** <https://discuss.elastic.co/t/logstash-configuration-error/89432>\
**Category:** Logstash\
**Created:** [June 14, 2017, 5:42pm UTC](https://discuss.elastic.co/t/logstash-configuration-error/89432 "2017-06-14T17:42:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ViJaY\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijay_s/32/42280_2.png) [@ViJaY\_S](https://discuss.elastic.co/u/ViJaY_S)\
**Post date:** [June 14, 2017, 5:42pm UTC](https://discuss.elastic.co/t/logstash-configuration-error/89432/1 "2017-06-14T17:42:58Z")

</div>

Hello,

Could you please help to fix the logstash configuration error, I see the below error while running configuration test.

Due to this issue importing new logs to ELK server is stopped,

* * *

Sending logstash logs to /var/log/logstash/logstash.log.  
Error: Expected one of #, input, filter, output at line 229, column 1 (byte 4803) after  
You may be interested in the '--configtest' flag which you can  
use to validate logstash's configuration before you choose  
to restart a running system.

logstash is not running

* * *

Please find the attached Logstash configuration file.

---

<div class="post-metadata">

**Author:** ![ViJaY\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijay_s/32/42280_2.png) [@ViJaY\_S](https://discuss.elastic.co/u/ViJaY_S)\
**Post date:** [June 14, 2017, 7:04pm UTC](https://discuss.elastic.co/t/logstash-configuration-error/89432/2 "2017-06-14T19:04:05Z")

</div>

\<

Logstash Configuration file -Here you go.

filter {  
grok {

```
match => {
	'message' => '\A%{TIMESTAMP_ISO8601:DateTime}%{SPACE}%{URIPATHPARAM:URI}%{SPACE}%{INT:Status}%{SPACE}%{QUOTEDSTRING:ComputerName}%{SPACE}%{QUOTEDSTRING:Referer}%{SPACE}%{INT:Win32Status}%{SPACE}%{NUMBER:BytesSent}%{SPACE}%{NUMBER:BytesReceived}%{SPACE}%{QUOTEDSTRING:UserAgent}%{SPACE}%{IP:ServerIP}%{SPACE}%{INT:ServerPort}%{SPACE}%{QUOTEDSTRING:Protocol}%{SPACE}%{PROG:Method}%{SPACE}%{IP:ClientIP}%{SPACE}%{NUMBER:TimeTaken}%{SPACE}%{NUMBER:RequestPerSecond}%{SPACE}%{HOSTNAME:WebSiteName}%{SPACE}%{GREEDYDATA:QRY}'

}

```

}

# The timestamp may have commas instead of dots. Convert so as to store everything in the same way

```
mutate {
	gsub => [
            # replace all commas with dots
            "DateTime", ",", "."
	        "DateTime", " ", ";"
			"ComputerName", "\"", ""
			"Referer", "\"", ""
			"Protocol", "\"", ""
	]
		}

#mutate {
#	gsub => [
        # make the logTimestamp sortable. With a space, it is not! This does not work that well, in the end

        # but somehow apparently makes things easier for the date filter

```

# "DateTime", " ", ";"

```
	#]
#}

```

# User Agent

```
useragent { 
	add_tag => ["UA"] 
	source => "UserAgent" 
} 

date {

	locale => "en"
	match => ["DateTime", "YYYY-MM-dd;HH:mm:ss.SSS"]
	target => "@timestamp"
}

if [type] == "IISlogs" { 
	if [UserAgent] != "-" and [UserAgent] != "" { 
		useragent { 
		add_tag => ["UA"] 
		source => "UserAgent" 
		} 
	} 

	if "UA" in [tags] { 
		if [device] == "Other" { mutate { remove_field => "device" } } 
		if [name] == "Other" { mutate { remove_field => "name" } } 
		if [os] == "Other" { mutate { remove_field => "os" } } 
	}
}

geoip {
	source => "ClientIP"
	target => "geoip"
	database =>"/etc/logstash/GeoLiteCity.dat"
	add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
	add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
} 

mutate {
	convert => ["[geoip][coordinates]", "float" ]
	convert => ["BytesSent", "integer"]
	convert => ["BytesReceived", "integer"]
	convert => ["RequestsPerSecond", "integer"]
}

```

}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 15, 2017, 1:04am UTC](https://discuss.elastic.co/t/logstash-configuration-error/89432/3 "2017-06-15T01:04:29Z")

</div>

Can you please reformat your config using the code button - `</>` - to make it easier to read.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2017, 1:04am UTC](https://discuss.elastic.co/t/logstash-configuration-error/89432/4 "2017-07-13T01:04:35Z")

</div>

Closed on July 13, 2017, 1:04am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.