# Logstash immediately shuts down upon launch in container due to YAML

**URL:** <https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452>\
**Category:** Logstash\
**Created:** [November 24, 2020, 7:07am UTC](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452 "2020-11-24T07:07:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![weiyentan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weiyentan/32/78619_2.png) [@weiyentan](https://discuss.elastic.co/u/weiyentan)\
**Post date:** [November 24, 2020, 7:07am UTC](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452/1 "2020-11-24T07:07:57Z")

</div>

Hi, I have a logstash.yml file that I am using the http api listener.

I have it listening for some post request inputs that has some Json bod's.

Now i am in the process of processing the json. I have some complex json that I want to use the filter.  
I thought that I could use the following code but I as soon as my container spins up with this yml the container shuts down. The following is my code. If any one can help with my syntax I willl be most grateful.

```auto
input {
  http {
    port => 6000 # default: 8080
    codec => json
  }
}

filter {
  json{
    source => "message"
  }
  split {
    field => "patchesneeded"
    add_field =>{
      computername => "computername"
    }
  }
  split {
    field => "software"
    add_field =>{
      computername => "computername"
  }
}
output {
    elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    index => "system-inventory-[version]}-%{+YYYY.MM.dd}"
    }
    stdout {
    codec => rubydebug
    }
}

```

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [November 24, 2020, 7:10am UTC](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452/2 "2020-11-24T07:10:43Z")

</div>

Hi,

I think your second split is missing a closing bracket: The one for add\_field seems to be missing.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2020, 7:10am UTC](https://discuss.elastic.co/t/logstash-immediately-shuts-down-upon-launch-in-container-due-to-yaml/256452/3 "2020-12-22T07:10:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.