# Logstash configuration file error

**URL:** <https://discuss.elastic.co/t/logstash-configuration-file-error/125373>\
**Category:** Logstash\
**Created:** [March 23, 2018, 1:37pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-error/125373 "2018-03-23T13:37:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [March 23, 2018, 1:37pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-error/125373/1 "2018-03-23T13:37:06Z")

</div>

For the life of me I cannot figure out why my logstash.conf file is wrong.

```
input{
	tcp{
		host => "127.0.0.1"
		port => 514 
	}
	udp{
		host => "127.0.0.1"
		port => 514 
	}
}
filter{
		grok{
			match => { “message” => [
												    “<%{INT:severity}>%{SYSLOGTIMESTAMP:datestamp} %{HOSTNAME:hostName} %{WORD:processName}: \[%{SYSLOGPROG:fileName}](\[%{INT:lineNumber}]:)? %{GREEDYDATA:logMessage}”,
												    “<%{INT:severity}>%{SYSLOGTIMESTAMP:datestamp} %{SYSLOGHOST:hostName} %{SYSLOGPROG:syslog_program}((\[|-)%{POSINT:syslog_pid}(\])?)?: %{GREEDYDATA:syslog_message}”,
												    “<%{INT:severity}>%{SYSLOGTIMESTAMP:datestamp} %{HOSTNAME:hostName} %{WORD:processName}: %{GREEDYDATA:logMessage}”
												  ]
			}
		}    	
}
output{
	if “_grokparsefailure” not in [tags]{
		elasticsearch{
		index => “sys-”
		document_type => “syslog”
		hosts => [“http://127.0.0.1:9200”] #x.x.x.x is IP address of server
		}
	}
	else{
		file{
			path => “${HOME}/profiles/CDR/ELK/syslog_fails.txt”
		}
	}
}

```

It says the error is:

> "Expected one of #, -, ", ', } at line 13, column 15 (byte 132) after filter{\n\t\tgrok{\n\t\t\tmatch =\> { "

---

<div class="post-metadata">

**Author:** ![Caleb\_Chaney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caleb_chaney/32/54110_2.png) [@Caleb\_Chaney](https://discuss.elastic.co/u/Caleb_Chaney)\
**Post date:** [March 23, 2018, 1:48pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-error/125373/2 "2018-03-23T13:48:28Z")

</div>

It looks like Logstash doesn't like the quotation marks used in a few parts of your config:`"“"/"”"` vs `"""`

Find and replace all instances of `"“"/"”"` with `"""` and that should get you past this first hurdle.

Edited hoping formatting changes will help make the subtleties more obvious.

---

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [March 23, 2018, 1:55pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-error/125373/3 "2018-03-23T13:55:31Z")

</div>

Thanks for the quick reply. I didn't even notice that. Unsure of how that happened. Changed all instances and it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2018, 1:55pm UTC](https://discuss.elastic.co/t/logstash-configuration-file-error/125373/4 "2018-04-20T13:55:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.