# Logstash error. Expected symbols

**URL:** <https://discuss.elastic.co/t/logstash-error-expected-symbols/262752>\
**Category:** Logstash\
**Created:** [January 31, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752 "2021-01-31T12:11:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![111435](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111435/32/81005_2.png) [@111435](https://discuss.elastic.co/u/111435)\
**Post date:** [January 31, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/1 "2021-01-31T12:11:03Z")

</div>

Hello, I am new at logstash, so please could you help me.  
I have this log:  
**2021-01-27 00:20:10 GET /ads/servlet/dbRequest?BNumber=353&ANumber=485739274 200 0.013**  
There are tabs between "date", "time", "GET" and "/ads"

My filte is:  
filter {  
grok { match =\> {"message" =\> "(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY})\t(?%{HOUR}:%{MINUTE}:%{SECOND})\t%{WORD:method}"  
}  
}  
if “\_grokparsefailure” in [tags]  
{  
drop {}  
}  
}

Why when I am trying to start logstash it gives this failure?

lineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "(", "!", '"', \0-9], "[", [A-Za-z\_], '/', "{" at line 11, column 4 (byte 274) after filter { \ngrok { match =\> {"message" =\> "(?%{YEAR}\-%{MONTHNUM}\-%{MONTHDAY})\t(?%{HOUR}\:%{MINUTE}\:%{SECOND})\t%{WORD:method}"}}\nif "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in`compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `in

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a656d51390460f7b816c4ead6ae813be4d21d2d2.png)

But when I am trying in [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) it works

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/d/dd9525ff23ac69f8faeee2e7a1344120d2356ddd.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [January 31, 2021, 12:47pm UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/2 "2021-01-31T12:47:16Z")

</div>

The below example might work better for you.

**Pattern**

`%{TIMESTAMP_ISO8601:timestamp} %{DATA:method} %{GREEDYDATA:path}`

**Returns**

```auto
{
          "path" => "/ads/servlet/dbRequest?BNumber=353&ANumber=485739274 200 0.013",
     "timestamp" => "2021-01-27 00:20:10",
        "method" => "GET"
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 31, 2021, 5:03pm UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/3 "2021-01-31T17:03:20Z")

</div>

> [@111435](#):
>
> if “\_grokparsefailure” in [tags]

Those appear to be curly quotes rather than straight double quotes: `"`. logstash only accepts the latter.

---

<div class="post-metadata">

**Author:** ![111435](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111435/32/81005_2.png) [@111435](https://discuss.elastic.co/u/111435)\
**Post date:** [February 3, 2021, 8:57am UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/4 "2021-02-03T08:57:43Z")

</div>

Thank you, now I see thish logs and index pattern does not creates.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/e/def2cfd3d6bcb1c5b2db9524f7960e1505a1adc4.png)

May be it because there are tabs between "date", "time", "GET" and "/ads"?  
I put logs in Word and see this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c8ef76a3d5b08c68b4eadb7bf0f150d00760128.png)

my conf file:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ec1674f69c992563b23f9ed81d068a617f200647.png)

---

<div class="post-metadata">

**Author:** ![111435](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111435/32/81005_2.png) [@111435](https://discuss.elastic.co/u/111435)\
**Post date:** [February 3, 2021, 8:59am UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/5 "2021-02-03T08:59:10Z")

</div>

Thank you.

---

<div class="post-metadata">

**Author:** ![111435](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111435/32/81005_2.png) [@111435](https://discuss.elastic.co/u/111435)\
**Post date:** [February 3, 2021, 11:38am UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/6 "2021-02-03T11:38:34Z")

</div>

I solved this problem using [\t]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2021, 11:39am UTC](https://discuss.elastic.co/t/logstash-error-expected-symbols/262752/7 "2021-03-03T11:39:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.