# Logstash is failing with syntax error

**URL:** <https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring, docker\
**Created:** [September 19, 2025, 7:35am UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073 "2025-09-19T07:35:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![piyush\_hn](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\
**Post date:** [September 19, 2025, 7:35am UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073/1 "2025-09-19T07:35:39Z")

</div>

Hi All,

Please advise on the below error, w.r.t the .conf file.

> [2025-09-19T07:11:21,135][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "=\>" at line 3, column 9 (byte 27) after input {\n input {\n beats ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:294:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:227:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "org/jruby/RubyClass.java:949:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:50:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:420:in `block in converge\_state'"]}  
> [2025-09-19T07:11:21,137][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600, :ssl\_enabled=\>false}  
> [2025-09-19T07:11:21,152][INFO][logstash.runner] Logstash shut down.  
> [2025-09-19T07:11:21,156][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit  
> org.jruby.exceptions.SystemExit: (SystemExit) exit  
> at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]  
> at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]  
> at usr.share.logstash.lib.bootstrap.environment.(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]

logstash.conf file is as follows,

> input {  
> beats {  
> port =\> 5044  
> }  
> }  
> filter {  
> if [message] =~ /^{.\*}$/ {  
> json {  
> source =\> "message"  
> }  
> }  
> mutate {  
> remove\_field =\> ["event", "message", "emailAddress"]  
> add\_field =\> { "env" =\> "development" }  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["[https://3.110.119.20:9200](https://3.110.119.20:9200)"]  
> index =\> "my-index"  
> ssl\_verification\_mode =\> "none"  
> user=\> "elastic"  
> password=\> "Q2vhC\_aNrn46lWKHntBL"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [September 19, 2025, 8:30am UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073/2 "2025-09-19T08:30:51Z")

</div>

Your syntax is OK. Can you check is there another .conf in the same directory?  
Are you running in the service or process mode?  
You can test the .conf fiel from the cmd line with option `-t` to validate .conf file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 19, 2025, 12:05pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073/3 "2025-09-19T12:05:49Z")

</div>

> [@piyush\_hn](#):
>
> Expected one of [\t\r\n], "#", "=\>" at line 3, column 9 (byte 27) after input {\n input {\n beats "

That would suggest that your configuration file is not

```auto
input {
  beats {
    port => 5044

```

but is actually

```auto
input {
  input {
    beats {

```

In which case remove one of the “input {“ lines.

---

<div class="post-metadata">

**Author:** ![piyush\_hn](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\
**Post date:** [September 19, 2025, 5:18pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073/4 "2025-09-19T17:18:36Z")

</div>

Okay thanks.