# Logstash Startup&Configuration error

**URL:** <https://discuss.elastic.co/t/logstash-startup-configuration-error/160829>\
**Category:** Logstash\
**Created:** [December 13, 2018, 11:40pm UTC](https://discuss.elastic.co/t/logstash-startup-configuration-error/160829 "2018-12-13T23:40:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kavin\_Kumaran](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@Kavin\_Kumaran](https://discuss.elastic.co/u/Kavin_Kumaran)\
**Post date:** [December 13, 2018, 11:40pm UTC](https://discuss.elastic.co/t/logstash-startup-configuration-error/160829/1 "2018-12-13T23:40:44Z")

</div>

Hi,  
Getting the below mentioned error while starting the logstash can anyone help to resolve this issue.Thanks in advance  
Filter.conf:

//  
**filter {**  
\*\* if [type] == "tomcat"{\*\*  
\*\* codec =\> multiline {\*\*  
\*\* pattern =\> "(^[a-zA-Z.]+(?:Error|Exception).+)|(^\s+at .+)|(^\s+... \d+ more)|(^\t+)|(^\s\*Caused by:.+)"\*\*  
\*\* negate =\> "true"\*\*  
\*\* what =\> "previous"\*\*  
\*\* }\*\*  
\*\* grok {\*\*  
\*\* match =\> { "source" =\> "%{GREEDYDATA}/%{GREEDYDATA:filename}.log" }\*\*  
\*\* }\*\*  
\*\* grok {\*\*  
\*\* match =\> { "source" =\> "%{GREEDYDATA}/%{GREEDYDATA:tenant}.log" }\*\*  
\*\* }\*\*  
\*\* mutate {\*\*  
\*\* lowercase =\> ["tenant"]\*\*  
\*\* }\*\*  
\*\* date {\*\*  
\*\* match =\> ["time", "yyyy-MM-dd-HH-mm-ss-SSS"]\*\*  
\*\* target =\> "@timestamp"\*\*  
\*\* }\*\*  
\*\* }\*\*  
**}**  
//

Error log:  
[2018-12-13T15:53:40,512][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2018-12-13T15:54:02,945][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.5.2"}  
[2018-12-13T15:54:04,496][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 13, column 15 (byte 271) after filter { \n if [type] == "tomcat"{\n codec ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:42:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in`block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in`exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:in`block in converge\_state'"]}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 17, 2018, 8:20am UTC](https://discuss.elastic.co/t/logstash-startup-configuration-error/160829/2 "2018-12-17T08:20:06Z")

</div>

You can not have a standalone codec in the filter section. This has to be linked to an input or output plugin.

Your grok patterns also does not seem to make much sense to me.

It would probably be easier if you showed your full config, your data as well as what you want to transform it into.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2019, 8:20am UTC](https://discuss.elastic.co/t/logstash-startup-configuration-error/160829/3 "2019-01-14T08:20:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.