# Problem with Output section

**URL:** <https://discuss.elastic.co/t/problem-with-output-section/78786>\
**Category:** Logstash\
**Created:** [March 16, 2017, 1:50am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786 "2017-03-16T01:50:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 16, 2017, 1:50am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786/1 "2017-03-16T01:50:36Z")

</div>

I am building a conf file to use a template for all other csv ingestion to ES indexes I need. This conf was working (in a simpler) form and is based on a v2 dev logstash install. Question...

Has the syntax changed when using file filter and csv plug-in?  
Should column names always be lowercase only?  
Logstash says my output is the problem. I am using Sublime 3 on a mac and starting to suspect my editor is creating characters unfriendly for logstash. What text editor is safe to use for conf files on osx?

btw: Line 40 Column 18 is the line...elasticsearch {

Here is my error message and conf file

greg$ bin/logstash -f ~/logstash-5.2.1/test\_file.conf --debug --verbose  
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.  
Sending Logstash's logs to /Users/greg/logstash-5.2.1/logs which is now configured via log4j2.properties  
[2017-03-15T21:43:22,699][ERROR][logstash.agent] fetched an invalid config {:config=\>"input {\nfile {\npath =\> "/Users/greg/logstash-5.2.1/efast\_master.csv"\nstart\_position =\> "beginning"\nsincedb\_path =\> "/dev/null"\n}\n}\nfilter {\ncsv {\nseparator =\> ","\ncolumns =\> ["Company","MOA\_Number","MOA\_Org","TaskOrder","ProjectName",\n "AwardType","FunctionalArea","AwardDate","EndDate","OptionsRemaining",\n "TotalValue","PMORouteSymbol"]\n}\nmutate {\n \n convert =\> { \n "TotalValue" =\> "float" \n "TaskOrder" =\> "float" \n \n }\n }\n\ndate {\n match =\> ["AwardDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n }\n date {\n match =\> ["AwardDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n target =\> "AwardDate"\n }\ndate {\n match =\> ["EndDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n }\n date {\n match =\> ["EndDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n target =\> "EndDate"\n }\n\noutput {\n elasticsearch {\n hosts =\> "[http://localhost:9200](http://localhost:9200)"\n index =\> "efast"\n }\nstdout { codec =\> rubydebug }\n}\n", :reason=\>"Expected one of #, =\> at line 40, column 19 (byte 953) after filter {\ncsv {\nseparator =\> ","\ncolumns =\> ["Company","MOA\_Number","MOA\_Org","TaskOrder","ProjectName",\n "AwardType","FunctionalArea","AwardDate","EndDate","OptionsRemaining",\n "TotalValue","PMORouteSymbol"]\n}\nmutate {\n \n convert =\> { \n "TotalValue" =\> "float" \n "TaskOrder" =\> "float" \n \n }\n }\n\ndate {\n match =\> ["AwardDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n }\n date {\n match =\> ["AwardDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n target =\> "AwardDate"\n }\ndate {\n match =\> ["EndDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n }\n date {\n match =\> ["EndDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]\n target =\> "EndDate"\n }\n\noutput {\n elasticsearch "}

[CONF FILE BELOW]  
input {  
file {  
path =\> "/Users/greg/logstash-5.2.1/efast\_master.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
separator =\> ","  
columns =\> ["Company","MOA\_Number","MOA\_Org","TaskOrder","ProjectName",  
"AwardType","FunctionalArea","AwardDate","EndDate","OptionsRemaining",  
"TotalValue","PMORouteSymbol"]  
}  
mutate {

```
  convert => { 
    "TotalValue" => "float" 
    "TaskOrder" => "float" 
    
  }
  }

```

date {  
match =\> ["AwardDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]  
}  
date {  
match =\> ["AwardDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]  
target =\> "AwardDate"  
}  
date {  
match =\> ["EndDate" , "MM/dd/yyyy" ,"M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]  
}  
date {  
match =\> ["EndDate" , "MM/dd/yyyy","M/dd/yyyy","MM/d/yyyy" ,"M/d/yyyy"]  
target =\> "EndDate"  
}

output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "efast"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)\
**Post date:** [March 16, 2017, 2:02am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786/2 "2017-03-16T02:02:31Z")

</div>

> [@GregMeadows](#):
>
> hosts =\> "[http://localhost:9200](http://localhost:9200)"

might be worth trying:  
` hosts => ["http://localhost:9200"]`

edit:  
you might also add another } above output to close out your filter section

---

<div class="post-metadata">

**Author:** ![GregMeadows](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\
**Post date:** [March 16, 2017, 2:14am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786/3 "2017-03-16T02:14:50Z")

</div>

thanks it was the filter section...

question:

Is my config file the most current method to convert fields and set date fields for logstash?  
mutate {  
convert { fieldname =\> float  
date { target =\> "signeddate"

the dollar values when converted to float were truncated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 16, 2017, 5:31am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786/4 "2017-03-16T05:31:47Z")

</div>

> Is my config file the most current method to convert fields and set date fields for logstash?

Yes, your configuration looks fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2017, 5:31am UTC](https://discuss.elastic.co/t/problem-with-output-section/78786/5 "2017-04-13T05:31:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.