Logstash error {:reason=>"Expected one of #, \", ', }

Elastic Stack Logstash
1

hi, I have a problem for my logstash config. Need to help what's happen from my config

my config

input {
file {
["host", "127.0.0.1"]
path => "/drives/d/logstash-5.6.3/bin/data/Topping/Trigger/*.csv"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp},%{WORD:SERVICEID}|%{WORD:MSISDN}|%{WORD:RULEID}|%{WORD:AUDIENCEKEY}|%{WORD:treatment_code}|%{WORD:NEXTWAVE}|%{WORD:CAMPCODE}|(%{WORD:CURRENT})?|%{NUMBER:EVNETVALUE}|%{WORD:EVNETDTTM}|%{GREEDYDATA:NAMEVALUEPAIR},%{WORD:STATUS}" }
}
}
date {
match => [ "timestamp", "YYYY-MM-dd HH:mm:ss" ]
locale => en
}
output {
stdout {
codec => dots {}
}

This error

[2017-11-15T20:19:28,650][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"D:/logstash-5.6.3/modules/fb_apache/configuration"}
[2017-11-15T20:19:28,654][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"D:/logstash-5.6.3/modules/netflow/configuration"}
[2017-11-15T20:19:28,765][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, ", ', } at line 3, column 3 (byte 19) after input {\n\tfile {\n\t\t"}

2

["host", "127.0.0.1"]

This line doesn't belong here. I don't even know what you're trying to do.

3

i need to test in my laptop. I'm a newbie.

4

Uh, sure. But you still need to remove that line.

5

after remove it. and change output

input {
file {
path => "d:\logstash-5.6.3\bin\data\Topping\Trigger\CMXTrigger_170911105814_0_3.csv"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp},%{WORD:SERVICEID}|%{WORD:MSISDN}|%{WORD:RULEID}|%{WORD:AUDIENCEKEY}|%{WORD:treatment_code}|%{WORD:NEXTWAVE}|%{WORD:CAMPCODE}|(%{WORD:CURRENT})?|%{NUMBER:EVNETVALUE}|%{WORD:EVNETDTTM}|%{GREEDYDATA:NAMEVALUEPAIR},%{WORD:STATUS}" }
}
}
date {
match => [ "timestamp", "YYYY-MM-dd HH:mm:ss" ]
locale => en
}
output {
codec => plain {
format => "%{[timestamp]} %{[SERVICEID]} %{[MSISDN]} %{[RULEID]} (%{[treatment_code]}) %{[CAMPCODE]}"
}
file {
path => "D:\logstash-5.6.3\logs\topping_trigger.log"
}
}

have new error

2560-11-15 20:59:43,642 main DEBUG Reconfiguration complete for context[name=1d81eb93] at URI D:\logstash-5.6.3\config\log4j2.properties (org.apache.logging.log4j.core.LoggerContext@228b4210) with optional ClassLoader: null
[2017-11-15T20:59:43,698][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"D:/logstash-5.6.3/modules/fb_apache/configuration"}
[2017-11-15T20:59:43,703][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"D:/logstash-5.6.3/modules/netflow/configuration"}
[2017-11-15T20:59:43,850][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, input, filter, output at line 13, column 1 (byte 439) after "}

6

You're closing the filter block before the date filter instead of after.

If you indent your configuration file this mistake is very easy to spot.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.