LogStash not processing log as specified in pipeline.conf

Elastic Stack Logstash
1

I am using a pipeline.conf file to start LS
It looks like this:

input { 
	file { 
		path ==> "C:/Elastic-stack/logstash/event-data/apache_access.log"
	} 
} 

output { 
	stdout { 
		codec ==> rubydebug 
	} 
}

However, the file is not being processed and I am getting below error:

Short version:
message=>"Expected one of [ \t\r\n], "#", "=>"

Complete version:

C:\Elastic-stack\logstash>bin\logstash -f config\pipelines\pipeline.conf --config.reload.automatic
"Using bundled JDK: C:\Elastic-stack\logstash\jdk\bin\java.exe"
Sending Logstash logs to C:/Elastic-stack/logstash/logs which is now configured via log4j2.properties
[2023-10-18T11:35:03,582][INFO ][logstash.runner          ] Log4j configuration path used is: C:\Elastic-stack\logstash\config\log4j2.properties
[2023-10-18T11:35:03,584][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"8.10.4", "jruby.version"=>"jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.8+7 on 17.0.8+7 +indy +jit [x86_64-mswin32]"}
[2023-10-18T11:35:03,586][INFO ][logstash.runner          ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[2023-10-18T11:35:03,622][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2023-10-18T11:35:04,831][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 3, column 8 (byte 28) after input { \r\n\tfile { \r\n\t\tpath ", :backtrace=>["C:/Elastic-stack/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:931:in `new'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:49:in `execute'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]}
[2023-10-18T11:35:04,901][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}

I have tried anything I can think of, all variations of the path, relative path, slashes, backslashes, double slashes, the same error keeps happening.
Anyone an idea what is ailing here with the given error and conf file?

2

I got rid of the Tabs and used spaces instead, but also changed the arrows...:

input { 
 file { 
 path => "C:\Elastic-stack\logstash\event-data\apache_access.log"
 } 
}

output { 
 stdout { 
 codec => rubydebug
 } 
}

Now it works as expected
It also works fine with backslashes now

3

Hi,

Change from ==> to =>

As per the documentation

path => "/var/log/*"
4

Re,

Dont forget logstash is actually really helpful to detect missconfigurations, here you can read your error :

at line 3, column 8 (byte 28) after input { \r\n\tfile { \r\n\t\tpath "

At line 3 column 8, after file { path

Good luck !

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.