# Logtash Giving : : Expected one of #, input, filter, output at line 1, column 1 (byte 1) Error in syntax checking
**URL:** https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987
**Category:** Logstash
**Tags:** elastic-stack-alerting
**Created:** [March 29, 2022, 3:58pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987 "2022-03-29T15:58:53Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 3:58pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/1 "2022-03-29T15:58:53Z")
[WARN] 2022-03-29 15:12:27.166 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[FATAL] 2022-03-29 15:12:27.560 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, input, filter, output at line 1, column 1 (byte 1)
[ERROR] 2022-03-29 15:12:27.577 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
Steps That i tried to fix this :
1.I checked each pipelines it is giving configuration valid and OK .
For ex: sudo bin/logstash --config.test\_and\_exit -f /etc/logstash/conf.d/dmb\_prod.conf By checking this it is giving Ok for all pipelines.
So can someone help how i can know that what particular line is giving me that error ....
And also in the error message at last it is giving : Logstash stopped processing because of an error: (SystemExit) exit.
So is it a error that can effect processing of data in ES. I am ablwe to see data of this running pipelines but it is not consistent.
So also wanted to know about it as well...
Thanks
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 4:06pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/2 "2022-03-29T16:06:03Z")
What command are you using to start Logstash?
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 4:06pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/3 "2022-03-29T16:06:47Z")
Systemctl restart logstash
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 4:07pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/4 "2022-03-29T16:07:40Z")
But logstash is continously running in my case . I don't stop and restart it again and again
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 4:08pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/5 "2022-03-29T16:08:52Z")
Can you post your pipelines.yml config then?
When you run `sudo bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/dmb_prod.conf` it's checking that single config.
When you are running as a service it should utilize pipelines.yml and execute those pipeline (which there might be an error in). So the steps would be to look at the pipelines.yml first and then go to any of the pipelines that are being started by that.
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 4:11pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/6 "2022-03-29T16:11:49Z")
# This file is where you define your pipelines. You can define multiple.
# For more information on multiple pipelines, see the documentation:
# [Multiple Pipelines | Logstash](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)
- pipeline.id: dmb\_prod\_pip\_all\_org
path.config: "/etc/logstash/conf.d/dmb\_prod\_pip\_all\_org.conf"
##- pipeline.id: rest\_dmb\_prod\_pip\_all\_backup
## path.config: "/etc/logstash/conf.d/rest\_dmb\_prod\_pip\_all\_backup.conf"
- pipeline.id: dmb\_rest\_prod\_all
path.config: "/etc/logstash/conf.d/rest\_dmb\_prod\_pip\_all.conf"
pipeline.workers: 3
###- pipeline.id: rest\_dmb\_prod\_pip\_all\_org
### path.config: "/etc/logstash/conf.d/rest\_dmb\_prod\_pip\_all\_org.conf"
### pipeline.workers: 3
- pipeline.id: dmb\_soc\_prod\_all
path.config: "/etc/logstash/conf.d/dmb\_soc\_prod\_pip.conf"
- pipeline.id: rest\_dmb\_soc\_prod
path.config: "/etc/logstash/conf.d/rest\_dmb\_soc\_prod\_pip\_all.conf"
#- pipeline.id: dmb\_prod\_pip\_all\_backup
# path.config: "/etc/logstash/conf.d/dmb\_prod\_pip\_all\_backup.conf"
Above is Pipelines.yml.
And for checking each pipelines individually it is giving configuration ok status. But with just sudo bin/logstash --config.test\_and\_exit -f /etc/logstash/conf.d/
it is giving that errror
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/7 "2022-03-29T16:14:49Z")
for better understandin here is SS 🙂
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 4:20pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/8 "2022-03-29T16:20:38Z")
The one file you tested `dmb_prod.conf` isn't in the pipelines.yml file that I see.
What's in here is all the pipeline that will execute when you start Logstash as a service. I would go to each one of these and test. Also I am not quite sure what `##` and `###` will do. Should just be a single `#` to comment out a line so it doesn't execute.
I would also clean it up so it only has what you are executing to ensure there is no format or typos with all the comments.
```auto
- pipeline.id: dmb_prod_pip_all_org
path.config: "/etc/logstash/conf.d/dmb_prod_pip_all_org.conf"
- pipeline.id: dmb_rest_prod_all
path.config: "/etc/logstash/conf.d/rest_dmb_prod_pip_all.conf"
pipeline.workers: 3
- pipeline.id: dmb_soc_prod_all
path.config: "/etc/logstash/conf.d/dmb_soc_prod_pip.conf"
- pipeline.id: rest_dmb_soc_prod
path.config: "/etc/logstash/conf.d/rest_dmb_soc_prod_pip_all.conf"
```
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 4:25pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/9 "2022-03-29T16:25:18Z")
that dmb\_prod i used is just fir Example i expressed.
So,
1. Do i need to run sudo bin/logstash --config.test\_and\_exit -f /etc/logstash/conf.d/
this command for each pipelins?
and also do i need to run it for json filter as well ?
2. Do i need to remove ### this type of comments in pipelines .yml ?
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 4:30pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/10 "2022-03-29T16:30:28Z")
1. Yes. Test the config on any .conf file that is defined in the pipelines.yml
2. I would remove those comments.
```auto
[FATAL] 2022-03-29 15:12:27.560 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, input, filter, output at line 1, column 1 (byte 1)
```
This means the first character in one of those files does not start with one of the below.
`#` or `input` or `filter` or `output`
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 7:29pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/11 "2022-03-29T19:29:41Z")
Hi Aaron,
I checked for each pipeline individually but all shown configuration OK for all pipelines inside Pipelines.yml
---\> do i also need to check .json file with the sudo bin/logstash --config.test\_and\_exit -f /etc/logstash/conf.d/
this command ?
Is their any way i can find which particular file is causing this error . Because i checked for each .conf file with same command it is giving configuration ok.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 7:42pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/12 "2022-03-29T19:42:12Z")
When you run it as a service and tail the Logstash log does it give you the same error?
```auto
[FATAL] 2022-03-29 15:12:27.560 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, input, filter, output at line 1, column 1 (byte 1)
```
Or does it look different than what you got on the command line? I am asking because I think if you run it as a service it will include the `pipeline.id` in the error so you know which one it is.
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 7:44pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/13 "2022-03-29T19:44:06Z")
No , In the logstash logs it do not gives any error such as invalid configuration like that.....
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 29, 2022, 7:46pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/14 "2022-03-29T19:46:19Z")
I am not sure what's not working then. If you start Logstash as a service which part of the logs is indicating an error or failure?
I see the one when you started via command line but as a service is different.
---
### Author:  [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)
#### Post date: [March 29, 2022, 7:54pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/15 "2022-03-29T19:54:03Z")
I do not start logstash on daily basis.
And also when i check status of logstash at that time also it does not gives any error .....
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 26, 2022, 7:54pm UTC](https://discuss.elastic.co/t/logtash-giving-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-error-in-syntax-checking/300987/16 "2022-04-26T19:54:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.