Logstash is failing with syntax error

Elastic Stack Logstash
,
1

Hi All,

Please advise on the below error, w.r.t the .conf file.

[2025-09-19T07:11:21,135][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "=>" at line 3, column 9 (byte 27) after input {\n input {\n beats ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:294:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:227:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "org/jruby/RubyClass.java:949:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:420:in `block in converge_state'"]}
[2025-09-19T07:11:21,137][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2025-09-19T07:11:21,152][INFO ][logstash.runner ] Logstash shut down.
[2025-09-19T07:11:21,156][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]

logstash.conf file is as follows,

input {
beats {
port => 5044
}
}
filter {
if [message] =~ /^{.*}$/ {
json {
source => "message"
}
}
mutate {
remove_field => ["event", "message", "emailAddress"]
add_field => { "env" => "development" }
}
}
output {
elasticsearch {
hosts => ["https://3.110.119.20:9200"]
index => "my-index"
ssl_verification_mode => "none"
user=> "elastic"
password=> "Q2vhC_aNrn46lWKHntBL"
}
}

2

Your syntax is OK. Can you check is there another .conf in the same directory?
Are you running in the service or process mode?
You can test the .conf fiel from the cmd line with option -t to validate .conf file.

3

That would suggest that your configuration file is not

input {
  beats {
    port => 5044

but is actually

input {
  input {
    beats {

In which case remove one of the “input {“ lines.

4

Okay thanks.