# Problem with splitted logstash config file in logstash 7.7

**URL:** https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788
**Category:** Logstash
**Created:** [June 4, 2020, 2:41pm UTC](https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788 "2020-06-04T14:41:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)
#### Post date: [June 4, 2020, 2:41pm UTC](https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788/1 "2020-06-04T14:41:53Z")

</div>

We're migrating from logstash 6.5.4 to 7.7.0. In 6.5.4 we had our config files all in one directory, with a naming convention like 01\_. We pointed path.config to that directory and logstash concatenated the files as if it were one big file.

In 7.7 this seems to work differently. E.g. we had a file 50\_filter\_begin with just

```
filter {

```

And then in many files like 51\_drop\_some\_type we had

```
    if [type] == "xyz" { drop { id => "xyz_drop" } }

```

and to close all filter files we had 89\_filter\_end

```
}

```

This used to work, but when I try this setup with logstash 7.7, it complains with error messages like

```auto
[2020-06-04T15:25:29,588][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"else\", \"if\", [A-Za-z0-9_-], '\"', \"'\", \"}\" at line 268, column 1 (byte 8076) after filter {\n

```

The whole configuration works nicely with logstash 7.7 when I cat(1) the files together before starting logstash and then point it to the concatenated file. This is my current workaround.

Did I miss something in the migration documentation or has this functionality been removed?

CU, Joe

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 4, 2020, 2:53pm UTC](https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788/2 "2020-06-04T14:53:31Z")

</div>

This is a [known issue](https://github.com/elastic/logstash/issues/11637) introduced in 7.6.0. You have to wrap each individual file in

```
filter {
}

```

Depending on how you divide your filters right now that may be an almost trivial change, or a significant re-write.

---

<div class="post-metadata">

### Author: ![jammann](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jammann](https://discuss.elastic.co/u/jammann)
#### Post date: [June 4, 2020, 7:52pm UTC](https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788/3 "2020-06-04T19:52:30Z")

</div>

Thanks @Badger !

The same pattern applies to outputs (we have several there, too).

It was a trivial change. Actually, we obviously prefer this format, we just didn't expect this to change

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2020, 7:52pm UTC](https://discuss.elastic.co/t/problem-with-splitted-logstash-config-file-in-logstash-7-7/235788/4 "2020-07-02T19:52:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
