Logstash - Filter - Error message(LogStash::ConfigurationError)

Elastic Stack Logstash
1

When I start Logstash I get the below error.

filter{

mutate {

}

grok {
match => { "message" => "%{TIMESTAMP_ISO8601:requestTime}||%{WORD:type}||%{WORD:jobId}||%{DATA:edgeId}||%{GREEDYDATA:other}"}
#match => { "message" => "%{TIMESTAMP_ISO8601:requestTime}||%{WORD:type}||%{WORD:jobId}||%{DATA:edgeId}||%{WORD:statusCode}||%{GREEDYDATA:msg}"}
#match => { "message" => "%{TIMESTAMP_ISO8601:requestTime}||%{WORD:type}||%{WORD:jobId}||%{DATA:edgeId}||%{WORD:statusCode}"}
add_field => { "hostname" => "%{edgeId}" }
}

if [other] != "||"{
mutate {
split => ["other", "||"]
add_field => {"statusCode" => %{[other][0}}
add_field => {"msg" => %{[other][1}}
}
}else{
mutate {
add_field => {"statusCode" => %{[other]}}
add_field => {"msg" => ""}
}
}

mutate {
update => { "message" => "type:%{type},jobId:%{jobId},edgeId:%{edgeId},statusCode:%{statusCode},msg:%{msg},end" }
#update => { "message" => "type:%{type},jobId:%{jobId},edgeId:%{edgeId},statusCode:%{statusCode},end" }
remove_field => ["type","jobId","edgeId","statusCode","msg"]
}
}

2

You didn't post the error, but I can already tell you what you forgot the quotes around the strings for all three add_field commands as well as the closing ] for the first two.

Please always format code as code </> with correct indentation to make it readable.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.