# LogStash not processing log as specified in pipeline.conf **URL:** \ **Category:** Logstash\ **Created:** [October 18, 2023, 9:37am UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266 "2023-10-18T09:37:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![AmnonH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amnonh/32/122447_2.png) [@AmnonH](https://discuss.elastic.co/u/AmnonH)\ **Post date:** [October 18, 2023, 9:37am UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266/1 "2023-10-18T09:37:41Z")
I am using a pipeline.conf file to start LS It looks like this: ```auto input { file { path ==> "C:/Elastic-stack/logstash/event-data/apache_access.log" } } output { stdout { codec ==> rubydebug } } ``` However, the file is not being processed and I am getting below error: Short version: **message=\>"Expected one of [\t\r\n], "#", "=\>"** Complete version: ```auto C:\Elastic-stack\logstash>bin\logstash -f config\pipelines\pipeline.conf --config.reload.automatic "Using bundled JDK: C:\Elastic-stack\logstash\jdk\bin\java.exe" Sending Logstash logs to C:/Elastic-stack/logstash/logs which is now configured via log4j2.properties [2023-10-18T11:35:03,582][INFO][logstash.runner] Log4j configuration path used is: C:\Elastic-stack\logstash\config\log4j2.properties [2023-10-18T11:35:03,584][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"8.10.4", "jruby.version"=>"jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.8+7 on 17.0.8+7 +indy +jit [x86_64-mswin32]"} [2023-10-18T11:35:03,586][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED] [2023-10-18T11:35:03,622][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2023-10-18T11:35:04,831][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 3, column 8 (byte 28) after input { \r\n\tfile { \r\n\t\tpath ", :backtrace=>["C:/Elastic-stack/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:931:in `new'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:49:in `execute'", "C:/Elastic-stack/logstash/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]} [2023-10-18T11:35:04,901][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false} ``` I have tried anything I can think of, all variations of the path, relative path, slashes, backslashes, double slashes, the same error keeps happening. Anyone an idea what is ailing here with the given error and conf file? ---
**Author:** ![AmnonH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amnonh/32/122447_2.png) [@AmnonH](https://discuss.elastic.co/u/AmnonH)\ **Post date:** [October 18, 2023, 10:29am UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266/2 "2023-10-18T10:29:58Z")
I got rid of the Tabs and used spaces instead, but also changed the arrows...: ```auto input { file { path => "C:\Elastic-stack\logstash\event-data\apache_access.log" } } output { stdout { codec => rubydebug } } ``` Now it works as expected It also works fine with backslashes now ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [October 18, 2023, 2:20pm UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266/3 "2023-10-18T14:20:34Z")
Hi, Change from ==\> to =\> As per the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) ```auto path => "/var/log/*" ``` ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [October 18, 2023, 2:22pm UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266/4 "2023-10-18T14:22:27Z")
Re, Dont forget logstash is actually really helpful to detect missconfigurations, here you can read your error : > at line 3, column 8 (byte 28) after input { \r\n\tfile { \r\n\t\tpath " At line 3 column 8, after file { path Good luck ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 15, 2023, 2:22pm UTC](https://discuss.elastic.co/t/logstash-not-processing-log-as-specified-in-pipeline-conf/345266/5 "2023-11-15T14:22:41Z")
Closed on November 15, 2023, 2:22pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.