Logstash start error!

Elastic Stack Logstash
1

i try to start logstash with config file but it can't work

ERROR:
[2019-02-19T16:59:48,269][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError"
, :message=>"Expected one of #, input, filter, output at line 3, column 1 (byte 76) after ", :backtrace=>["/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'" , "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'" , "org/jruby/RubyArray.java:2486:inmap'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'"
, "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'"
, "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'"
, "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/agent.rb:92:inexclusive'"
, "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/home/zhenqinghe/elk/logstash-6.6.0/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}

my conf file :
input {
file {
path => ["/home/zhenqinghe/elk/testlog/*.log"]
type => "kettle_log"
start_position => "beginning"
}
}

filter {
grok {
patterns_dir => ["/home/zhenqinghe/elk/logstash-6.6.0/config/patterns"]
match => {
"message" => ["%{KETTLE_DATE}:kettle_date"]
}
}

date {
    match => ["kettle_date", "dd/MMM/yyyy:HH:mm:ss Z"]
}

}

output {
file {
path => "/home/zhenqinghe/elk/resultlog/%{host}.log"
message_format => "%{message}"
}
}

2

That configuration would not generate that error. Do you have any other files in the directory that contains the configuration? If you point -f at a directory then logstash will concatenate all the files in the directory to create the configuration.

"message" => ["%{KETTLE_DATE}:kettle_date"]

If you want to capture the string that matches the KETTLE_DATE pattern then that should be

"message" => ["%{KETTLE_DATE:kettle_date}"]

This is not valid either. If you want to specify the format you would use the codec option on the output.

message_format => "%{message}"
1 Like
4

Thanks for you help!

if i have own patterns file , I just need to add patterns_dir in configuration file ？
like:

patterns_dir => ["/home/zhenqinghe/elk/logstash-6.6.0/config/patterns"]

5

That is correct.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.