# Logstash POSTFIX pipeline error

**URL:** <https://discuss.elastic.co/t/logstash-postfix-pipeline-error/236429>\
**Category:** Elastic Stack\
**Tags:** docker\
**Created:** [June 9, 2020, 11:45pm UTC](https://discuss.elastic.co/t/logstash-postfix-pipeline-error/236429 "2020-06-09T23:45:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![igormarqs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igormarqs/32/17678_2.png) [@igormarqs](https://discuss.elastic.co/u/igormarqs)\
**Post date:** [June 9, 2020, 11:45pm UTC](https://discuss.elastic.co/t/logstash-postfix-pipeline-error/236429/1 "2020-06-09T23:45:31Z")

</div>

Hi, i have the pipeline below running in old ELK stack. The old stack have Logstash version 2.4.1. We have no problem whit this old version of logstash running this pipeline.

**Now we have built new stack whit docker and i'm trying to run the same pipeline but i get some errors.**

Here is the pipeline:

```auto
####################################################
### INPUT
####################################################
input {
    file {
        type => "postfix"
        path => "/var/log/maillog"
    }
}

filter {
    grok {
        #type => "postfix"
        patterns_dir => ["/etc/logstash/postfix_grok_pattern"]
        pattern => [
            "%{SYSLOGBASE} %{POSTFIXSMTPDCONNECTS}",
            "%{SYSLOGBASE} %{POSTFIXSMTPDACTIONS}",
            "%{SYSLOGBASE} %{POSTFIXSMTPDTIMEOUTS}",
            "%{SYSLOGBASE} %{POSTFIXSMTPDLOGIN}",
            "%{SYSLOGBASE} %{POSTFIXSMTPDCLIENT}",
            "%{SYSLOGBASE} %{POSTFIXSMTPRELAY}",
            "%{SYSLOGBASE} %{POSTFIXSMTPCONNECT}",
            "%{SYSLOGBASE} %{POSTFIXSMTP4XX}",
            "%{SYSLOGBASE} %{POSTFIXSMTP5XX}",
            "%{SYSLOGBASE} %{POSTFIXSMTPREFUSAL}",
            "%{SYSLOGBASE} %{POSTFIXSMTPLOSTCONNECTION}",
            "%{SYSLOGBASE} %{POSTFIXSMTPTIMEOUT}",
            "%{SYSLOGBASE} %{POSTFIXBOUNCE}",
            "%{SYSLOGBASE} %{POSTFIXQMGR}",
            "%{SYSLOGBASE} %{POSTFIXCLEANUP}"
        ]
        named_captures_only => true
    }
}

####################################################
### OUTPUT
####################################################
output {
  elasticsearch {
     hosts => ["http://es01:9200"]
     index => "postfix-%{+YYYY.MM.dd}"
     user => elastic
     password => "ABCDEF" 
        }        
    }

```

And this is the error that i get when start logstash docker (logstash version 7.7.0):

```auto
[2020-06-09T22:28:01,028][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 3, column 1 (byte 69) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in `block in converge_state'"]}
[2020-06-09T22:28:01,363][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2020-06-09T22:28:06,232][INFO][logstash.runner] Logstash shut down.

```

Any idea why is not working or how can i fix this?  
Any help will be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/logstash-postfix-pipeline-error/236429/2 "2022-11-04T08:01:51Z")

</div>