# Logstash error

**URL:** <https://discuss.elastic.co/t/logstash-error/277048>\
**Category:** Logstash\
**Created:** [June 25, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-error/277048 "2021-06-25T11:04:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ashwin\_Patil1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashwin_patil1/32/90642_2.png) [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Post date:** [June 25, 2021, 11:04am UTC](https://discuss.elastic.co/t/logstash-error/277048/1 "2021-06-25T11:04:48Z")

</div>

I have installed logstash and the following is the .conf file  
input {  
beat {  
port =\> 5044  
type =\> syslog  
}  
}

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

output {  
if [beat][hostname] == "ip-192.168.1.12"  
elasticsearch {  
hosts =\> "192.168.16.11:9200"  
index =\> "Win\_syslog-%{+YYYY.MM.dd}"  
user =\> "elastic"  
password =\> "**"  
}  
else {  
elasticsearch {  
hosts =\> "192.168.16.11:9200"  
index =\> "syslog-%{+YYYY.MM.dd}"  
user =\> "elastic"  
password =\> "**"  
}

```
	}

```

}

When I start logstash service and run tail, I get the following error,  
localhost:~ # tail /var/log/logstash/logstash-plain.log

[2021-06-25T11:29:59,952][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties  
[2021-06-25T11:29:59,978][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.13.2", "jruby.version"=\>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86\_64]"}  
[2021-06-25T11:30:03,223][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2021-06-25T11:30:04,965][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "and", "or", "xor", "nand", "{" at line 23, column 3 (byte 552) after output {\n\tif [beat][hostname] == "ip-192.168.1.12"\n\t\t", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:389:in `block in converge\_state'"]}  
[2021-06-25T11:30:05,179][INFO][logstash.runner] Logstash shut down.  
[2021-06-25T11:30:05,197][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit  
org.jruby.exceptions.SystemExit: (SystemExit) exit  
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.16.0.jar:?]  
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.16.0.jar:?]  
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]

---

<div class="post-metadata">

**Author:** ![Betorov](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Post date:** [June 25, 2021, 12:29pm UTC](https://discuss.elastic.co/t/logstash-error/277048/2 "2021-06-25T12:29:14Z")

</div>

Try this:

output:

```auto
output {
if [beat][hostname] == "ip-192.168.1.12"
      {
elasticsearch {
hosts => "192.168.16.11:9200"
index => "Win_syslog-%{+YYYY.MM.dd}"
user => "elastic"
password => ""
}
}
else {
elasticsearch {
hosts => "192.168.16.11:9200"
index => "syslog-%{+YYYY.MM.dd}"
user => "elastic"
password => ""
}

	}
}

```

---

<div class="post-metadata">

**Author:** ![Ashwin\_Patil1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashwin_patil1/32/90642_2.png) [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Post date:** [June 25, 2021, 3:42pm UTC](https://discuss.elastic.co/t/logstash-error/277048/3 "2021-06-25T15:42:44Z")

</div>

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-error/277048/4 "2021-07-23T15:43:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.