Hi,
Getting the below mentioned error while starting the logstash can anyone help to resolve this issue.Thanks in advance
Filter.conf:
//
filter {
** if [type] == "tomcat"{**
** codec => multiline {**
** pattern => "(^[a-zA-Z.]+(?:Error|Exception).+)|(^\s+at .+)|(^\s+... \d+ more)|(^\t+)|(^\s*Caused by:.+)"**
** negate => "true"**
** what => "previous"**
** }**
** grok {**
** match => { "source" => "%{GREEDYDATA}/%{GREEDYDATA:filename}.log" }**
** }**
** grok {**
** match => { "source" => "%{GREEDYDATA}/%{GREEDYDATA:tenant}.log" }**
** }**
** mutate {**
** lowercase => ["tenant"]**
** }**
** date {**
** match => ["time", "yyyy-MM-dd-HH-mm-ss-SSS"]**
** target => "@timestamp"**
** }**
** }**
}
//
Error log:
[2018-12-13T15:53:40,512][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2018-12-13T15:54:02,945][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.2"}
[2018-12-13T15:54:04,496][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 13, column 15 (byte 271) after filter { \n if [type] == "tomcat"{\n codec ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}