# LogStash ConfigurationError
**URL:** https://discuss.elastic.co/t/logstash-configurationerror/156004
**Category:** Logstash
**Created:** [November 9, 2018, 8:25am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004 "2018-11-09T08:25:57Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@aruntracer](https://discuss.elastic.co/u/aruntracer)
#### Post date: [November 9, 2018, 8:25am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/1 "2018-11-09T08:25:57Z")
Log.conf
```
1524206424.034 19395 207.96.0.0 TCP_MISS/304 15363 GET http://elastic.co/android-chrome-192x192.gif - DIRECT/10.0.5.120 -
1524206424.145 106 207.96.0.0 TCP_HIT/200 68247 GET http://elastic.co/guide/en/logstash/current/images/logstash.gif - NONE/- image/gif
```
logstash.conf
```
input
{
file{
path=> "/home/arun1297/POC/logs/log.conf"
start_position=> "beginning"
sincedb_path => "/dev/null"
}
}
filter {
dissect {
mapping => {
"message" => "%{timestamp->} %{duration} %{client_address} %{cache_result}/%{status_code} %{bytes} %{request_method} %{url} %{user} %{hierarchy_code}/%{server} %{content_type}"
}
remove_field => [“message”]
}
}
output {
stdout {
codec => rubydebug
}
}
```
I'm getting below error when I run bin/logstash -f logstash.conf
```
[2018-11-09T13:55:13,466][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, \", ', -, [, {,] at line 15, column 21 (byte 388) after filter {\r\n dissect {\r\n mapping => {\r\n \"message\" => \"%{timestamp->} %{duration} %{client_address} %{cache_result}/%{status_code} %{bytes} %{request_method} %{url} %{user} %{hierarchy_code}/%{server} %{content_type}\"\r\n }\r\n remove_field => [", :backtrace=>["/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in `initialize'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "/home/arun1297/Downloads/logstash-6.4.2/logstash-core/lib/logstash/agent.rb:309:in `block in converge_state'"]}
```
---
### Author:  [@aruntracer](https://discuss.elastic.co/u/aruntracer)
#### Post date: [November 9, 2018, 8:36am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/2 "2018-11-09T08:36:10Z")
If I remove `remove_field => [“message”]` from filter it works.. but this code was given in elastic search tutorial.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 9, 2018, 8:46am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/3 "2018-11-09T08:46:44Z")
In which tutorial was this example given?
---
### Author:  [@aruntracer](https://discuss.elastic.co/u/aruntracer)
#### Post date: [November 9, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/4 "2018-11-09T08:51:52Z")
yes correct! from [https://www.elastic.co/blog/a-practical-introduction-to-logstash](https://www.elastic.co/blog/a-practical-introduction-to-logstash)
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 9, 2018, 9:47am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/5 "2018-11-09T09:47:36Z")
It worked fine when I wrote that blog post. It seems the issue is with the quotation marks in the remove\_field statement. If I replace them with `"`or copy it straight from the blog post it all works though. I therefore wonder if you have had them replaced while copying and pasting them somehow?
---
### Author:  [@aruntracer](https://discuss.elastic.co/u/aruntracer)
#### Post date: [November 9, 2018, 9:55am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/6 "2018-11-09T09:55:14Z")
If I copied from blog the code is this `remove_field => [“message”]` and if I manually enter and the code is this `remove_field => ["message"]` which is correct double quotation mark.. some problem with keyboard layout I guess.. Thanks! Now it is working
---
### Author:  [@sandhyaks](https://discuss.elastic.co/u/sandhyaks)
#### Post date: [November 27, 2018, 10:17am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/7 "2018-11-27T10:17:23Z")
Am facing the same issue ...... can someone pls help ... below is my config file
input {
file{
path =\> ["/etc/data/dept\_subsystem.csv"]
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
csv {
separator =\> ","
columns =\> ["Universal Id","State","Sv","Age","CQ Pri","CMVC ID","CMVC Track","CR Fix Date","Platform","Subsys","Reported Release","Release","Fix Potential","Component","Phase Found","Submitter","Owner","Headline","Symptoms","Keywords","Reference","LastUpdate","DaysSinceOpen","Dept","Projected Date","Action","Subm Dept","CI"]
}
}
output{
elasticsearch{
hosts =\> "localhost"
index =\> "defects\_new1"
document\_type =\> "defects\_temp1"
}
stdout{}
}
---
### Author:  [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)
#### Post date: [November 27, 2018, 10:19am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/8 "2018-11-27T10:19:39Z")
Please open a new thread and post any errors you are getting.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2018, 10:19am UTC](https://discuss.elastic.co/t/logstash-configurationerror/156004/9 "2018-12-25T10:19:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.