Logstash Startup&Configuration error


(Kavin Kumaran) #1

Hi,
Getting the below mentioned error while starting the logstash can anyone help to resolve this issue.Thanks in advance
Filter.conf:

//
filter {
** if [type] == "tomcat"{**
** codec => multiline {**
** pattern => "(^[a-zA-Z.]+(?:Error|Exception).+)|(^\s+at .+)|(^\s+... \d+ more)|(^\t+)|(^\s*Caused by:.+)"**
** negate => "true"**
** what => "previous"**
** }**
** grok {**
** match => { "source" => "%{GREEDYDATA}/%{GREEDYDATA:filename}.log" }**
** }**
** grok {**
** match => { "source" => "%{GREEDYDATA}/%{GREEDYDATA:tenant}.log" }**
** }**
** mutate {**
** lowercase => ["tenant"]**
** }**
** date {**
** match => ["time", "yyyy-MM-dd-HH-mm-ss-SSS"]**
** target => "@timestamp"**
** }**
** }**
}
//

Error log:
[2018-12-13T15:53:40,512][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2018-12-13T15:54:02,945][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.2"}
[2018-12-13T15:54:04,496][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, { at line 13, column 15 (byte 271) after filter { \n if [type] == "tomcat"{\n codec ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}


(Christian Dahlqvist) #2

You can not have a standalone codec in the filter section. This has to be linked to an input or output plugin.

Your grok patterns also does not seem to make much sense to me.

It would probably be easier if you showed your full config, your data as well as what you want to transform it into.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.