# LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\]

**URL:** <https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315>\
**Category:** Logstash\
**Created:** [February 15, 2021, 1:11pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315 "2021-02-15T13:11:36Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 1:11pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/1 "2021-02-15T13:11:36Z")

</div>

Hi Guys,

Good Day!!

I am facing the issue while staring the logstash.

LogStash::ConfigurationError", :message=\>"Expected one of [A-Za-z0-9\_-] [\t\r\n], "#", "{", [A-Za-z0-9\_], "}" at line 49, column 31 (byte 1290) after output {\n if "total" in [tags] {\n elasticsearch {\n index =\> ["totalexecution\_%{indexName}\_%{+YYYY}"]\n hosts =\> ["[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)"]\n user =\> elastic\n password =\> Global", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge\_state'"]}

' 1 input {  
2 beats {  
3 port =\> "5044"  
4 }  
5 }  
6  
7  
8 filter {  
9 grok {  
10 match =\> {"message" =\> "%{LOGLEVEL:loglevel} %{NUMBER:tenantId} %{NUMBER:organizationUnitId} %{GREEDYDATA:message}"}  
11 overwrite =\> ["message"]  
12 }  
13 json {  
14 source =\> "message"  
15 }  
16  
17 if [message] != "" {  
18 if "execution ended" in [message] {  
19 mutate { add\_tag =\> ["total"] }  
20 }  
21 if "Info" in [level] or "Warn" in [level] or "Error" in [level] or "Fatal" in [level] {  
22 mutate { add\_tag =\> ["default"] }  
23 }  
24 else {  
25 drop {}  
26 }  
27 }  
28 else {  
29 if "management\_" in [indexName] {  
30 mutate { add\_tag =\> ["management"] }  
31 }  
32 else if "environmentcheck\_" in [indexName] {  
33 mutate { add\_tag =\> ["environmentcheck"] }  
34 }  
35 else {  
36 mutate { add\_tag =\> ["robotic"] }  
37 }  
38 }  
39 ruby { path =\> "/etc/logstash/ruby\_scripts/index\_name\_script.rb" }  
40 }  
43 output {  
44 if "total" in [tags] {  
45 elasticsearch {  
46 index =\> ["totalexecution\_%{indexName}_%{+YYYY}"]  
47 hosts =\> ["[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)"]  
48 user =\> elastic  
49 password =\> Changeme@123  
50 ssl =\> true  
51 cacert =\> "/etc/logstash/elasticsearch-ca.pem"  
52 }  
53 }  
54 if "default" in [tags] {  
55 elasticsearch {  
56 index =\> ["default_%{indexName}_%{+YYYY}"]  
57 hosts =\> ["[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)"]  
58 user =\> elastic  
59 password =\> Changeme@123  
60 ssl =\> true  
61 cacert =\> "/etc/logstash/elasticsearch-ca.pem"  
62 }  
63 }  
64 if "management" in [tags] {  
65 elasticsearch {  
66 index =\> ["management_%{indexName}_%{+YYYY.MM}"]  
67 hosts =\> [""[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)"]  
68 user =\> elastic  
69 password =\> Changeme@123  
70 ssl =\> true  
71 cacert =\> "/etc/logstash/elasticsearch-ca.pem"  
72 }  
73 }  
74 if "robotic" in [tags] {  
75 elasticsearch {  
76 index =\> ["robot_%{indexName}_%{+YYYY.MM}"]  
77 hosts =\> ["[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)"]  
78 user =\> elastic  
79 password =\> Changeme@123  
80 ssl =\> true  
81 cacert =\> "/etc/logstash/elasticsearch-ca.pem"  
82 }  
83 }  
84 if "environmentcheck" in [tags] {  
85 elasticsearch {  
86 index =\> ["environmentcheck_%{indexName}\_%{+YYYY}"]  
87 hosts =\> ["[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)", "[https://ip:9200](https://ip:9200)" ]  
88 user =\> elastic  
89 password =\> Changeme@123  
90 ssl =\> true  
91 cacert =\> "/etc/logstash/elasticsearch-ca.pem"  
92 }  
93 }  
94 }`

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 1:28pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/2 "2021-02-15T13:28:31Z")

</div>

**line 49 and column 31** is referring special characters. Do we not use special characters in password?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2021, 5:23pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/3 "2021-02-15T17:23:29Z")

</div>

You need to put quotes around the password.

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 5:25pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/4 "2021-02-15T17:25:45Z")

</div>

Thanks for your reply @Badger

I did that. But now i am getting this error now.

==\> /var/log/logstash/logstash-plain.log \<==  
[2021-02-15T18:20:32,308][INFO][logstash.runner] Logstash shut down.  
[2021-02-15T18:20:32,343][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit  
[2021-02-15T18:21:05,877][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.9.1", "jruby.version"=\>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.202-b08 on 1.8.0\_202-b08 +indy +jit [linux-x86\_64]"}  
[2021-02-15T18:21:06,947][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2021-02-15T18:21:12,986][INFO][org.reflections.Reflections] Reflections took 176 ms to scan 1 urls, producing 22 keys and 45 values  
[2021-02-15T18:21:13,956][INFO][logstash.filters.ruby.script] Test run complete {:script\_path=\>"/etc/logstash/ruby\_scripts/index\_name\_script.rb", :results=\>{:passed=\>0, :failed=\>0, :errored=\>0}}  
[2021-02-15T18:21:15,231][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}  
[2021-02-15T18:21:15,763][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2021-02-15T18:21:20,567][INFO][logstash.runner] Logstash shut down.  
[2021-02-15T18:21:20,652][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2021, 5:27pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/5 "2021-02-15T17:27:20Z")

</div>

I suggest you enable log.level debug and see if you get a more informative error message.

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 5:31pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/6 "2021-02-15T17:31:36Z")

</div>

you mean this "bin/logstash -f /etc/logstash/ --log.level debu" ?

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 5:46pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/7 "2021-02-15T17:46:22Z")

</div>

Where i can share the logs its too big and i coundn't find any thing ☹

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 6:07pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/10 "2021-02-15T18:07:10Z")

</div>

[https://gist.github.com/muthug91/d9e898d3880bfb4073c06d053e6212b0](https://gist.github.com/muthug91/d9e898d3880bfb4073c06d053e6212b0)

I have attached the log.level --debug

i am unable to find any thing kindly help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2021, 6:35pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/11 "2021-02-15T18:35:26Z")

</div>

There is nothing there that indicates what the error is because the error did not occur. logstash successfully started and then

```
^C[WARN] 2021-02-15 18:33:17.143 [SIGINT handler] runner - SIGINT received. Shutting down.

```

you killed it.

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 6:39pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/12 "2021-02-15T18:39:59Z")

</div>

You are right, i stopped it because it looks looped by below message.

[DEBUG] 2021-02-15 19:39:55.499 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:39:55.499 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:39:57.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:00.504 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:00.504 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:02.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:05.509 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:05.510 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:07.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:10.518 [pool-5-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:10.519 [pool-5-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:12.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:15.524 [pool-5-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:15.524 [pool-5-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:17.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:20.529 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:20.529 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:22.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:25.534 [pool-5-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:25.534 [pool-5-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:27.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:30.552 [pool-5-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:30.552 [pool-5-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:32.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:35.556 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:35.557 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:37.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:40.563 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:40.563 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:42.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:45.567 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:45.568 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:47.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:50.573 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:50.573 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}  
[DEBUG] 2021-02-15 19:40:52.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.  
[DEBUG] 2021-02-15 19:40:55.580 [pool-6-thread-1] jvm - collector name {:name=\>"ParNew"}  
[DEBUG] 2021-02-15 19:40:55.581 [pool-6-thread-1] jvm - collector name {:name=\>"ConcurrentMarkSweep"}

Note:- It is new configuration, there is no data. Once i enabled xpack security in ES, i am unable to start logstash and getting below error

[2021-02-15T18:20:32,343][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit  
[2021-02-15T18:21:05,877][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.9.1", "jruby.version"=\>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.202-b08 on 1.8.0\_202-b08 +indy +jit [linux-x86\_64]"}  
[2021-02-15T18:21:06,947][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2021-02-15T18:21:12,986][INFO][org.reflections.Reflections] Reflections took 176 ms to scan 1 urls, producing 22 keys and 45 values  
[2021-02-15T18:21:13,956][INFO][logstash.filters.ruby.script] Test run complete {:script\_path=\>"/etc/logstash/ruby\_scripts/index\_name\_script.rb", :results=\>{:passed=\>0, :failed=\>0, :errored=\>0}}  
[2021-02-15T18:21:15,231][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}  
[2021-02-15T18:21:15,763][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2021-02-15T18:21:20,567][INFO][logstash.runner] Logstash shut down.  
[2021-02-15T18:21:20,652][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2021, 6:43pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/13 "2021-02-15T18:43:10Z")

</div>

So enable log.level debug when you have x-pack security enabled. Look particularly for certificate related debug messages.

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 6:46pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/14 "2021-02-15T18:46:18Z")

</div>

Kindly help how to do that?

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 15, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/15 "2021-02-15T19:02:21Z")

</div>

anything you can able to help here ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2021, 7:57pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/16 "2021-02-15T19:57:30Z")

</div>

You were able to enable log.level debug before and posted the results. Do that again when x-pack security is enabled.

---

<div class="post-metadata">

**Author:** ![muthug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthug/32/82555_2.png) [@muthug](https://discuss.elastic.co/u/muthug)\
**Post date:** [February 16, 2021, 3:21am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/17 "2021-02-16T03:21:35Z")

</div>

The provide log.level debug was took while xpack security is enabled

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 16, 2021, 3:27am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/18 "2021-02-16T03:27:30Z")

</div>

You are telling us that sometimes that produces

```auto
[2021-02-15T18:21:15,231][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

```

and sometimes it produces

```auto
[INFO] 2021-02-15 18:32:00.190 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[DEBUG] 2021-02-15 18:32:00.196 [Converge PipelineAction::Create<main>] javapipeline - Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x342a6c6e run>"}

```

That seems unlikely if you are running the same configuration in both cases.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2021, 3:27am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315/19 "2021-03-16T03:27:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.