# Logstash::ConfigurationError:message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 3, column 1 (byte 3) after \\n\\n"
**URL:** https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723
**Category:** Logstash
**Created:** [February 11, 2020, 7:31am UTC](https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723 "2020-02-11T07:31:59Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Varun\_Saraf](https://discuss.elastic.co/u/Varun_Saraf)
#### Post date: [February 11, 2020, 7:31am UTC](https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723/1 "2020-02-11T07:31:59Z")
**logstash shows the following error. what is the error in configuration file?**
VARSARAF-M-PAPE:~ varsaraf$ logstash -f /usr/local/etc/logstash/conf.d/syslog.conf
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to /usr/local/Cellar/logstash/7.5.2/libexec/logs which is now configured via log4j2.properties
[2020-02-11T12:46:42,806][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-02-11T12:46:42,898][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.5.2"}
[2020-02-11T12:46:43,526][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "input", "filter", "output" at line 3, column 1 (byte 3) after \n\n", :backtrace=\>["/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:156:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/local/Cellar/logstash/7.5.2/libexec/logstash-core/lib/logstash/agent.rb:326:in `block in converge\_state'"]}
[2020-02-11T12:46:43,768][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
[2020-02-11T12:46:48,889][INFO][logstash.runner] Logstash shut down.
**My configuration file is also given below-**
```
input {
file {
path=>["/var/log/*.log", "/var/log/messages", "/var/log/syslog"]
type=>"syslog"
}
}
filter {
if [type] == "syslog" {
grok {
match=> { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field=>["received_at", "%{@timestamp}"]
add_field=>["received_from", "%{host}"]
}
syslog_pri { }
date {
match=>["syslog_timestamp", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss"] }
}
}
output {
elasticsearch {
hosts=>["127.0.0.1:9200"]
index=>"syslog-demo"
}
stdout { codec=>rubydebug }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 10, 2020, 7:32am UTC](https://discuss.elastic.co/t/logstash-message-expected-one-of-t-r-n-input-filter-output-at-line-3-column-1-byte-3-after-n-n/218723/2 "2020-03-10T07:32:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.