"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace

Elastic Stack Logstash
1

Hi team,

I am getting below exception .I have mentioned .conf file and log file which is given input to the .conf.Please let suggest.
Exception:
{:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in block in converge_state'"]}q1`12w

portal.conf:
input {

file {
path => [ "/opt/glassfish9/glassfish/domains/domain1/config/logs/lcportal_transaction.log" ]
#start_position => "beginning"
sincedb_path => "/etc/logstash/Portal.sincedb"
type => "lcportal_transactionlog"
}
}

filter {

if ([type] == "lcportal_transactionlog") {
grok {
match => ["message","%{DATA:requestTime},%{DATA:BusinessCategory},%{DATA:spId},%{DATA:appId},%{DATA:fromNEType},%{DATA:toNEType},%{DATA:latency},%{DATA:result},%{DATA:subId},"]
}
}
mutate{
gsub => [
"host",".","",
"BusinessCategory",".",""
]

       }
metrics {
    meter => ["metrics.%{host}.%{appId}.%{BusinessCategory}.%{result}"]
    timer => ["metrics.%{host}.%{appId}.T9lat","%{latency}"]
    clear_interval => 60
    flush_interval => 60
    rates => []
    percentiles => []
}

}

output {
graphite {
host => "XX.XXX.X.X"
port => XXXX
fields_are_metrics => true
exclude_metrics => ["%{[^}]+}", "requestTime","latency","BusinessCategory","spId","appId","fromNEType","toNEType","resultCode","subId","host","message","type","path"]
resend_on_failure => true
}
}

lcportal_transaction.log

2020-05-08 04:51:37.246,SB.SUBS@T_Service,xxxxxx,T_Service,LC_T,SB_SXXX,2001,500,d9499e82-9e41-454c-9e62,
2020-05-08 04:51:37.244,SB.SUBS@T_Service,xxxxxx,T_Service,LC_T,SB_SXXX,2002,500,d9499e82-9e41-454c-9e62,
2020-05-08 04:51:37.230,SB.SUBS@T_Service,xxxxxx,T_Service,LC_T,SB_SXXX,2002,500,1b5326b8-ad11-4da3-b44a,
2020-05-08 04:51:37.222,SB.SUBS@T_Service,xxxxxx,T_Service,LC_T,SB_SXXX,2005,500,2f03f58d-3074-4466-9e92,

2

syntax error in your conf, line 1. you don’t have that portal.conf statement in your conf file by any chance ?

3

Hi Tamba,

Thanks for the response my .conf has the syntax issues.

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.