"}
logstash\_1 | [2019-06-14T07:52:58,856][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=\>".monitoring-logstash"}
logstash\_1 | [2019-06-14T07:53:01,439][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
logstash\_1 | [2019-06-14T07:53:07,471][INFO][logstash.javapipeline] Pipeline terminated {"pipeline.id"=\>".monitoring-logstash"}
logstash\_1 | [2019-06-14T07:53:08,217][INFO][logstash.runner] Logstash shut down.
docker-elk\_logstash\_1 exited with code 0
---
### Author:  [@turnip](https://discuss.elastic.co/u/turnip)
#### Post date: [June 14, 2019, 8:02am UTC](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788/2 "2019-06-14T08:02:34Z")
Here is a look at the `logstash.conf` file that may be causing the problem.
I cant identify where the problem is caused
```auto
input {
tcp {
port => 5000
}
gelf {
port => 12200
codec => json
type => nginx
}
gelf {
port => 12201
codec => json
type => app
}
}
filter {
if [type] == "nginx" {
json {
source => message
add_tag => ["%{tag}"]
tag_on_failure => ["error"]
}
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
if "error" in [tags] {
mutate {
rename => {"message" => "error"}
}
}
mutate {
rename => {"tag" => "server_name"}
remove_field => ["@version", "timestamp", "command", "message", "level"]
}
}
if [type] == "app" {
json {
source => message
add_tag => ["%{tag}"]
}
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
mutate {
remove_field => ["@version", "timestamp", "command", "level"]
}
# drop debug log
# if [server_name] == "oauth-server" and [log_level] == "DEBUG" {
# drop { }
# }
# if [server_name] == "oauth-server" and [log_level] == "INFO" {
# drop { }
# }
# if [server_name] == "bff-server" and "/user/authorise" in [message] {
# drop { }
# }
# if [server_name] == "bff-server" and "/user/signup" in [message] {
# drop { }
# }
# if [server_name] == "bff-server" and "/user/reset_password" in [message] {
# drop { }
# }
# if [server_name] == "bff-server" and "/user/change_password" in [message] {
# drop { }
# }
# if [server_name] == "bff-server" and "/user/password/reset" in [message] {
# drop { }
# }
# if [server_name] == "bff-server" and [log_level] == "DEBUG" and "/oauth/token" in [message] {
# drop { }
# }
}
}
## Add your filters / logstash plugins configuration here
output {
elasticsearch {
hosts => "elasticsearch:9200"
user => elastic
password => newPassword
}
}
```
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [June 14, 2019, 11:29pm UTC](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788/3 "2019-06-14T23:29:49Z")
> [@turnip](#):
>
> Expected one of #, { at line 101, column 16 (byte 2020) after output {\r\n\telasticsearch {\r\n\t\thosts =\> "elasticsearch:9200"\r\n\t\tuser =\> elastic\r\n\t\tpassword =\> P
I believe you need to quote your password, adding `"` before and after it. While the logstash configuration language allows some "barewords" to be included without quoting, more complex strings typically break the rules with special characters and need to be provided in a quoted manner.
I would advise using a environment variables or storing the credentials in the Java Keystore, which would enable you to have:
```auto
output {
elasticsearch {
hosts => "elasticsearch:9200"
user => "${ELASTICSEARCH_USERNAME}"
password => "${ELASTICSEARCH_PASSWORD}"
}
}
```
Docs on the Keystore can be found [here](https://www.elastic.co/guide/en/logstash/current/keystore.html), and docs on environment variable substitution can be found [here](https://www.elastic.co/guide/en/logstash/current/environment-variables.html).
* * *
Additionally, I believe the error message you have pasted includes the first character of your password, so it would be wise to change the password again.
---
### Author:  [@turnip](https://discuss.elastic.co/u/turnip)
#### Post date: [June 17, 2019, 2:27am UTC](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788/4 "2019-06-17T02:27:08Z")
thanks, adding quotation to user and password as you said worked well!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2019, 2:36am UTC](https://discuss.elastic.co/t/logstash-not-working-after-changing-password/185788/5 "2019-07-15T02:36:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.