Here's the full error:
[2022-01-06T13:10:34,532][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:logs-companycom-filebeat-1-dev01-01, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"if\", [A-Za-z0-9_-], '\"', \"'\", \"}\" at line 150, column 5 (byte 3922) after output {\n if \"company2mod_calls\" in [tags]\n { \n elasticsearch\n {\n hosts => [\"https://dc-es09.companydm.com:9200\" , \"https://dc-es10.companydm.com:9200\"]\n ssl => true\n cacert => \"path/logstash/certs/company_Root.crt\"\n ssl_certificate_verification => true\n user => logstash_user\n password => \"${logstash.user.password}\"\n sniffing => false\n manage_template => false\n index => \"dev-companycom-logs-%{+YYYY.MM.dd}\"\n ilm_enabled => false \n #ilm_rollover_alias => \"dev-mod-logs\"\n #ilm_pattern => \"{now/d}-000001\"\n #ilm_policy => \"DEV_mod_ILM_Policy\"\n }\n }\n else if \"companysql_calls\" in [tags]\n {\n ", :backtrace=>["path/logstash/logstash-7.13.2/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "path/logstash/logstash-7.13.2/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "path/logstash/logstash-7.13.2/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "path/logstash/logstash-7.13.2/logstash-core/lib/logstash/agent.rb:389:in `block in converge_state'"]}
And here's the full config:
input {
# beats {
# port => 5356
# client_inactivity_timeout => "86400"
# }
file {
path => "/tmp/companycom.json"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
if "[\]{3}" in [source] {
json{
source => "message"
}
if "beats_input_codec_plain_applied" in [tags] {
mutate {
remove_tag => "beats_input_codec_plain_applied"
}
}
mutate {
gsub => ["message","\\"",""]
}
mutate {
remove_field => [ "[agent][id]","[agent][type]","[agent][hostname]","[agent][ephemeral_id]","[agent][version]","[ecs][version]","[log][offset]","[input][type]","[beat][name]","[beat][hostname]","[beat][version]","[prospector][type]","offset","sessionId","host"]
lowercase => [ "logLevel" ]
}
mutate {
rename => { "machineName" => "jvm" }
rename => { "SourceContext" => "loggerName" }
rename => { "url" => "requestUri" }
}
mutate {
add_field => {"logFilePath" => "%{[log][file][path]}"}
add_tag => ["file-based"]
}
mutate{
update => { "responseBody" => "" }
}
if "_" in [coorelationId] {
mutate {
add_field => ["tempcid", "%{coorelationId}"]
}
mutate{
split => ["tempcid", "_"]
add_field => {"sessionId" => "%{[tempcid][0]}"}
add_field => {"GUID" => "%{[tempcid][1]}"}
add_field => {"endPointIdentifier" => "%{[tempcid][2]}"}
}
mutate{
remove_field => ["tempcid"]
}
}
if "companydm" in [hostname]
{
mutate {
add_field => ["tempHostName", "%{hostname}"]
}
mutate{
split => ["tempHostName", "-"]
add_field => {"dataCenter" => "%{[tempHostName][0]}"}
}
mutate{
remove_field => ["tempHostName"]
}
mutate{
lowercase => ["dataCenter"]
}
}
mutate {
remove_field => ["source"]
}
mutate {
add_tag => ["company2mod_calls"]
}
}
else if "[\]{3}" not in [source] {
json{
source => "message"
}
if "beats_input_codec_plain_applied" in [tags] {
mutate {
remove_tag => "beats_input_codec_plain_applied"
}
}
grok {
match => [ "message", "%{TIMESTAMP_ISO8601}\s*.*?%{HOUR}:%{MINUTE}\s*\[%{DATA:Info}\]\s*%{GREEDYDATA:Data}" ]
overwrite => [ "message" ]
}
json{
source => "Data"
}
mutate {
remove_field => ["source"]
}
mutate {
add_tag => ["companysql_calls"]
}
}
}
output {
if "company2mod_calls" in [tags]
{
elasticsearch
{
hosts => ["https://dc-es09.companydm.com:9200" , "https://dc-es10.companydm.com:9200"]
ssl => true
cacert => "path/logstash/certs/company_Root.crt"
ssl_certificate_verification => true
user => logstash_user
password => "${logstash.user.password}"
sniffing => false
manage_template => false
index => "dev-companycom-logs-%{+YYYY.MM.dd}"
ilm_enabled => false
#ilm_rollover_alias => "dev-mod-logs"
#ilm_pattern => "{now/d}-000001"
#ilm_policy => "DEV_mod_ILM_Policy"
}
}
else if "companysql_calls" in [tags]
{
{
hosts => ["https://dc-es09.companydm.com:9200" , "https://dc-es10.companydm.com:9200"]
ssl => true
cacert => "path/logstash/certs/company_Root.crt"
ssl_certificate_verification => true
user => logstash_user
password => "${logstash.user.password}"
sniffing => false
manage_template => false
index => "dev-companysql-logs-%{+YYYY.MM.dd}"
ilm_enabled => false
#ilm_rollover_alias => "dev-mod-logs"
#ilm_pattern => "{now/d}-000001"
#ilm_policy => "DEV_mod_ILM_Policy"
}
}
}