# \[Logstash\]:ConfigurationError ":message=\>"Expected one of #, input, filter, output "

**URL:** <https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045>\
**Category:** Logstash\
**Created:** [July 24, 2019, 1:43pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045 "2019-07-24T13:43:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moustapha\_Berrou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moustapha_berrou/32/50816_2.png) [@Moustapha\_Berrou](https://discuss.elastic.co/u/Moustapha_Berrou)\
**Post date:** [July 24, 2019, 1:43pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/1 "2019-07-24T13:43:28Z")

</div>

Dear all,

i am uploading a json file with Logstash 7.2.0 in to Elasticsearch =\> Grafana (All with Docker)

```
input{
  	file{
codec => multiline
    {
      pattern => '^{'
      negate => true
      what => previous
    }
path => ["/usr/share/logstash/pipeline/batch.json"]
start_position => "beginning"
sincedb_path => "/dev/null"
codec => "json"
    }
}

filter{
       	mutate{
               	replace => ["message", "%{message}"]
                gsub => ['message','\n','']
        }
	if [message] =~ /^{.*}$/
        {
                json { source => message }
        }

}

output {
        elasticsearch {
                hosts => ["localhost:9200"]
                index => "batch_1"
        }
	stdout {
                codec => rubydebug
        }
}

```

when i run this code, i receive the following error :

```
[ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 2, column 1 (byte 2) after \n", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
[2019-07-24T13:19:05,306][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 2, column 1 (byte 2) after \n", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
[2019-07-24T13:19:07,258][WARN][logstash.outputs.elasticsearch] You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch bulk_path=>"/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s", hosts=>[http://elasticsearch:9200], sniffing=>false, manage_template=>false, id=>"7d7dfa0f023f65240aeb31ebb353da5a42dc782979a2bd7e26e28b7cbd509bb3", document_type=>"%{[@metadata][document_type]}", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_20a8a096-3aff-454f-b8a8-51b6a5de5470", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, ilm_enabled=>"auto", ilm_rollover_alias=>"logstash", ilm_pattern=>"{now/d}-000001", ilm_policy=>"logstash-policy", action=>"index", ssl_certificate_verification=>true, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}

```

Can anyone guide me please !

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2019, 2:14pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/2 "2019-07-24T14:14:43Z")

</div>

> [@Moustapha\_Berrou](#):
>
> Expected one of #, input, filter, output at line 2, column 1 (byte 2) after \n"

If you have -f, or path.config pointed to a directory, then logstash will concatentate every file in the directory to create the configuration. That will include logstash.conf, logstash.conf.bak, jvm.options, random.txt. Every file. I suspect that is the issue here.

---

<div class="post-metadata">

**Author:** ![Moustapha\_Berrou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moustapha_berrou/32/50816_2.png) [@Moustapha\_Berrou](https://discuss.elastic.co/u/Moustapha_Berrou)\
**Post date:** [July 25, 2019, 8:42am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/3 "2019-07-25T08:42:22Z")

</div>

Thank you for taking the time to respond.

It's running with :

```
./bin/logstash -f pipeline/logstash.conf

```

And i receive the following error :

```
    OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
    WARNING: An illegal reflective access operation has occurred
    WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.7.0.jar) to field java.io.FileDescriptor.fd
    WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
    WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
    WARNING: All illegal access operations will be denied in a future release
    Thread.exclusive is deprecated, use Thread::Mutex
    Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
  [WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
  [INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.2.0"}
  [WARN][logstash.monitoringextension.pipelineregisterhook] xpack.monitoring.enabled has not been defined, but found elasticsearch configuration. Please explicitly set `xpack.monitoring.enabled: true` in logstash.yml
  [INFO][logstash.licensechecker.licensereader] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://elasticsearch:9200/]}}
  [WARN][logstash.licensechecker.licensereader] Restored connection to ES instance {:url=>"http://elasticsearch:9200/"}
  [INFO][logstash.licensechecker.licensereader] ES Output version determined {:es_version=>7}
  [logstash.licensechecker.licensereader] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
  [INFO][logstash.monitoring.internalpipelinesource] Monitoring License OK
  [INFO][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline.
  [ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"TypeError", :message=>"Java type is not serializable, cannot be marshaled class org.logstash.config.ir.imperative.PluginStatement", :backtrace=>["org/jruby/java/proxies/JavaProxy.java:400:in `marshal_dump'", "org/jruby/RubyMarshal.java:102:in `dump'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:213:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:203:in `block in deep_clone'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:203:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:201:in `block in deep_clone'", "org/jruby/RubyHash.java:1419:in `each'", "org/jruby/RubyEnumerable.java:1062:in `inject'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:201:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:55:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:57:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:258:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:120:in `buildInput'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
  [ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"TypeError", :message=>"Java type is not serializable, cannot be marshaled class org.logstash.config.ir.imperative.PluginStatement", :backtrace=>["org/jruby/java/proxies/JavaProxy.java:400:in `marshal_dump'", "org/jruby/RubyMarshal.java:102:in `dump'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:213:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:203:in `block in deep_clone'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:203:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:201:in `block in deep_clone'", "org/jruby/RubyHash.java:1419:in `each'", "org/jruby/RubyEnumerable.java:1062:in `inject'", "/usr/share/logstash/logstash-core/lib/logstash/util.rb:201:in `deep_clone'", "/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:55:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb:57:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:258:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:120:in `buildInput'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
  [WARN][logstash.outputs.elasticsearch] You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch bulk_path=>"/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s", hosts=>[http://elasticsearch:9200], sniffing=>false, manage_template=>false, id=>"7d7dfa0f023f65240aeb31ebb353da5a42dc782979a2bd7e26e28b7cbd509bb3", document_type=>"%{[@metadata][document_type]}", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_4239c90a-dbc5-47da-acd5-b39760251456", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, ilm_enabled=>"auto", ilm_rollover_alias=>"logstash", ilm_pattern=>"{now/d}-000001", ilm_policy=>"logstash-policy", action=>"index", ssl_certificate_verification=>true, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}
```

---

<div class="post-metadata">

**Author:** ![Moustapha\_Berrou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moustapha_berrou/32/50816_2.png) [@Moustapha\_Berrou](https://discuss.elastic.co/u/Moustapha_Berrou)\
**Post date:** [July 25, 2019, 8:44am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/4 "2019-07-25T08:44:06Z")

</div>

```
[INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://elasticsearch:9200/]}}
[logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://elasticsearch:9200/"}
[logstash.outputs.elasticsearch] ES Output version determined {:es_version=>7}
[logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://elasticsearch:9200"]}
[logstash.javapipeline] Starting pipeline {:pipeline_id=>".monitoring-logstash", "pipeline.workers"=>1, "pipeline.batch.size"=>2, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>2, :thread=>"#<Thread:0x12447b38 run>"}
[logstash.javapipeline] Pipeline started {"pipeline.id"=>".monitoring-logstash"}
[INFO][logstash.javapipeline] Pipeline terminated {"pipeline.id"=>".monitoring-logstash"}
[INFO][logstash.runner] Logstash shut down.
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 12:57pm UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/5 "2019-07-25T12:57:51Z")

</div>

Are you sure you are using a [supported](https://www.elastic.co/support/matrix#matrix_jvm) Java version?

---

<div class="post-metadata">

**Author:** ![Moustapha\_Berrou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moustapha_berrou/32/50816_2.png) [@Moustapha\_Berrou](https://discuss.elastic.co/u/Moustapha_Berrou)\
**Post date:** [July 26, 2019, 9:55am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/6 "2019-07-26T09:55:29Z")

</div>

@Badger yes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2019, 9:55am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-input-filter-output/192045/7 "2019-08-23T09:55:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.