Logstash Forwarder Error Log


Hi there,

Thanks a lot in advance.

I have configured the Logstash Forwarder on the cent os System but when i run the Logstash-forwarded .

i get this error message in the Error Log OF logstash Forwarder.

2015/05/14 06:31:33.326395 Failed unmarshalling json: invalid character '}' looking for beginning of object key string 2015/05/14 06:31:33.326543 Could not load config file /etc/logstash-forwarder.conf: invalid character '}' looking for beginning of object key string

can someone has any idea to help me out please.


(Magnus Bäck) #2

Your configuration file isn't valid JSON. There are tons of JSON validators out there so it shouldn't be hard to find one that does a better job of pointing you to the exact spot where the error is, but otherwise you can post your configuration here to get help from human eyes.


# The network section covers network configuration :slight_smile:
"network": {
# A list of downstream servers listening for our messages.
# logstash-forwarder will pick one at random and only switch if
# the selected one appears to be dead or unresponsive
"servers": [ "" ],

**# The path to your client ssl certificate (optional)**
**#"ssl certificate": "/etc/logstash-forwarder/server.crt",**
**# The path to your client ssl key (optional)**
**#"ssl key": "./logstash-forwarder.key",**

**# The path to your trusted ssl CA file. This is used**
**# to authenticate your downstream server.**
**"ssl ca": "/etc/logstash-forwarder/server.crt",**

**# Network timeout in seconds. This is most important for**
**# logstash-forwarder determining whether to stop waiting for an**
**# acknowledgement from the downstream server. If an timeout is reached,**
**# logstash-forwarder will assume the connection or server is bad and**
**# will connect to a server chosen at random from the servers list.**
**#"timeout": 15**


# The list of files configurations
"files": [
# An array of hashes. Each hash tells what paths to watch and
# what fields to annotate on events from those paths.
"paths": [
# single paths are fine
# globs are fine too, they will be periodically evaluated
# to see if any new files match the wildcard.

  **# A dictionary of fields to annotate on each event.**
  **#"fields": { "type": "syslog" }**
**}, #{**
  **# A path of "-" means stdin.**
  **#"paths": [ "-" ],**
  **#"fields": { "type": "stdin" }**
**#}, {**
  **#"paths": [**
  **#"fields": { "type": "apache" }**


This is my Configuration file!!

I have vpnc running on this machine and i am also trying to send this log to Logstash Server.

can Someone please help me with this!!!

Thanks In advance!

(Magnus Bäck) #4

Your configuration ends with


but this should be (not absence of comma):


(Next time, please look into the formatting of your messages. Configuration file snippets benefit from being formatted as code. Just select the text block and press Ctrl+K.)

"network": {
"servers": [ "" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"timeout": 15
"files": [
"paths": [
"fields": { "type": "syslog" }
"paths": [
"fields": { "type": "apache" }

This Config File works for me! But now i get error message of SSL Handsake Issue! I have this Internal Env. nad using Self Signed Cert.

Failed to tls handshake with x.x.x.x x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs

(Christian Dahlqvist) #6


The "paths" list also seem to contain two strings without a comma separating them. As Magnus suggested, please use a JSON validator, e.g. JSONLint, to validate your configuration files.

Best regards,



Thanks Magnus and Christian for suggesting Json Validator

(system) #8