# Logstash Forwarder Error Log

**URL:** <https://discuss.elastic.co/t/logstash-forwarder-error-log/662>\
**Category:** Logstash\
**Created:** [May 14, 2015, 4:32am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662 "2015-05-14T04:32:44Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![SJ04](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@SJ04](https://discuss.elastic.co/u/SJ04)\
**Post date:** [May 14, 2015, 4:32am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/1 "2015-05-14T04:32:44Z")

</div>

Hi there,

Thanks a lot in advance.

I have configured the Logstash Forwarder on the cent os System but when i run the Logstash-forwarded .

i get this error message in the Error Log OF logstash Forwarder.

_ **2015/05/14 06:31:33.326395 Failed unmarshalling json: invalid character '}' looking for beginning of object key string**** 2015/05/14 06:31:33.326543 Could not load config file /etc/logstash-forwarder.conf: invalid character '}' looking for beginning of object key string**_

can someone has any idea to help me out please.

thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 14, 2015, 10:02am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/2 "2015-05-14T10:02:24Z")

</div>

Your configuration file isn't valid JSON. There are tons of JSON validators out there so it shouldn't be hard to find one that does a better job of pointing you to the exact spot where the error is, but otherwise you can post your configuration here to get help from human eyes.

---

<div class="post-metadata">

**Author:** ![SJ04](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@SJ04](https://discuss.elastic.co/u/SJ04)\
**Post date:** [May 18, 2015, 5:56am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/3 "2015-05-18T05:56:28Z")

</div>

**{**  
**# The network section covers network configuration 🙂**  
**"network": {**  
**# A list of downstream servers listening for our messages.**  
**# logstash-forwarder will pick one at random and only switch if**  
**# the selected one appears to be dead or unresponsive**  
**"servers": ["10.30.1.119:6782"],**

```
**# The path to your client ssl certificate (optional)**
 **#"ssl certificate": "/etc/logstash-forwarder/server.crt",**
**# The path to your client ssl key (optional)**
 **#"ssl key": "./logstash-forwarder.key",**

**# The path to your trusted ssl CA file. This is used**
 **# to authenticate your downstream server.**
 **"ssl ca": "/etc/logstash-forwarder/server.crt",**

**# Network timeout in seconds. This is most important for**
 **# logstash-forwarder determining whether to stop waiting for an**
 **# acknowledgement from the downstream server. If an timeout is reached,**
 **# logstash-forwarder will assume the connection or server is bad and**
 **# will connect to a server chosen at random from the servers list.**
 **#"timeout": 15**

```

**},**

**# The list of files configurations**  
**"files": [**  
**# An array of hashes. Each hash tells what paths to watch and**  
**# what fields to annotate on events from those paths.**  
**{**  
**"paths": [**  
**# single paths are fine**  
**"/var/log/messages"**  
**# globs are fine too, they will be periodically evaluated**  
**# to see if any new files match the wildcard.**  
**"/var/log/vpnc/file.log"**  
**],**

```
  **# A dictionary of fields to annotate on each event.**
  **#"fields": { "type": "syslog" }**
 **}, #{**
  **# A path of "-" means stdin.**
  **#"paths": ["-"],**
  **#"fields": { "type": "stdin" }**
 **#}, {**
  **#"paths": [**
    **#"/var/log/apache/httpd-*.log"**
  **#],**
  **#"fields": { "type": "apache" }**
 **#}**

```

**],**  
**}**

This is my Configuration file!!

I have vpnc running on this machine and i am also trying to send this log to Logstash Server.

can Someone please help me with this!!!

Thanks In advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 18, 2015, 6:06am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/4 "2015-05-18T06:06:32Z")

</div>

Your configuration ends with

```
  ],
}

```

but this should be (not absence of comma):

```
  ]
}

```

(Next time, please look into the formatting of your messages. Configuration file snippets benefit from being formatted as code. Just select the text block and press Ctrl+K.)

---

<div class="post-metadata">

**Author:** ![SJ04](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@SJ04](https://discuss.elastic.co/u/SJ04)\
**Post date:** [May 18, 2015, 6:35am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/5 "2015-05-18T06:35:05Z")

</div>

```
{
"network": {
"servers": ["10.30.1.119:6782"],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"timeout": 15
},
"files": [
{
"paths": [
"/var/log/syslog",
"/var/log/*.log",
"/var/log/vpnc/file.log"
],
"fields": { "type": "syslog" }
},
{
"paths": [
"/var/log/apache2/*.log"
],
"fields": { "type": "apache" }
}
]
}

```

This Config File works for me! But now i get error message of SSL Handsake Issue! I have this Internal Env. nad using Self Signed Cert.

Failed to tls handshake with x.x.x.x x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 18, 2015, 6:35am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/6 "2015-05-18T06:35:24Z")

</div>

Hi,

The "paths" list also seem to contain two strings without a comma separating them. As Magnus suggested, please use a JSON validator, e.g. [JSONLint](http://jsonlint.com), to validate your configuration files.

Best regards,

Christian

---

<div class="post-metadata">

**Author:** ![SJ04](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@SJ04](https://discuss.elastic.co/u/SJ04)\
**Post date:** [May 18, 2015, 6:36am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/7 "2015-05-18T06:36:59Z")

</div>

Thanks Magnus and Christian for suggesting Json Validator

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/logstash-forwarder-error-log/662/8 "2017-07-06T05:39:44Z")

</div>