Logstash error when running .conf

(OpSec Monkey) #1

I get this error when running in centos 7

] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 15, column 11 (byte 289) after output {\n elasticsearch { host => ["http://localhost:9200"] }\n index ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}
[2019-01-13T22:14:17,708][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

Here is my config file

input {
file {
path => "/home/xxxxxxxx/Documents/conversion/*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
filter {
csv {
separator => ","
output {
elasticsearch { host => ["http://localhost:9200"] }
index => "xxxxx"
stdout {codec => rubydebug}

Does anyone have any ideas that can help me?

(Mark Walkom) #2

Remove the } in this line and you should be ok.

(OpSec Monkey) #3

Thanks. I knew it was going to be something like that. Thanks @warkolm.

Didnt work getting the same error as above.

(OpSec Monkey) #4

Does anyone have any recommendations?


Remove the trailing ? and change host to hosts.

(OpSec Monkey) #6


(system) closed #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.