Logstash New Field is not added

Elastic Stack Logstash
1

I am trying to add new field in my config file there is already a field message in my csv file i am trying to add test field . In this add field i want to copy of message data into test field for testing file my config file is

input
{
file
{
path => "C:/Users/Ubaid/Desktop/testmcb"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
csv {
separator => ","
columns => ["Insert_time","Mobile","Telco","Mask","Message","Test"]
}

date {
match => ["Insert_time","dd-MM-YYYY HH:mm"]
target => "Insert_time"
}

mutate {
add_field => {"Test", "%{[Message]}"}
}

}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "mcbdata-%{+dd.MM.YYYY}"
}
stdout {codec => json_lines }
}
After running this config file logstash start and service is stop can someone help whats wrong in my config file

2

What does the logstash log file show?

3

D:\ELK\Logstash\logstash-7.1.1\bin>logstash -f logstash_testmcb.conf
Sending Logstash logs to D:/ELK/Logstash/logstash-7.1.1/logs which is now configured via log4j2.properties
[2019-07-05T09:23:59,544][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-07-05T09:23:59,593][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.1.1"}
[2019-07-05T09:24:02,021][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 22, column 21 (byte 380) after filter { \r\n csv { \r\n separator => "," \r\n columns => ["Insert_time","Mobile","Telco","Mask","Message","Test"] \r\n }\r\n\r\ndate { \r\nmatch => ["Insert_time","dd-MM-YYYY HH:mm"] \r\n target => "Insert_time" \r\n} \r\n\r\nmutate {\r\nadd_field => {"Test"", :backtrace=>["D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}
[2019-07-05T09:24:02,712][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-07-05T09:24:07,472][INFO ][logstash.runner ] Logstash shut down.

4

That should be

mutate {
    add_field => { "Test" => "%{[Message]}" }
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.