# Send logstash events to log file problem

**URL:** <https://discuss.elastic.co/t/send-logstash-events-to-log-file-problem/135908>\
**Category:** Logstash\
**Created:** [June 14, 2018, 11:57am UTC](https://discuss.elastic.co/t/send-logstash-events-to-log-file-problem/135908 "2018-06-14T11:57:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [June 14, 2018, 11:57am UTC](https://discuss.elastic.co/t/send-logstash-events-to-log-file-problem/135908/1 "2018-06-14T11:57:06Z")

</div>

Hey,

I use logstash to parse filebeat events and then send these logs to a .txt file

This is my pipeline :

```
input
{
  beats
  {
    port => 5044
  }
}
filter
{
  grok
  {
    match => { "message" => ["%{WORD:TYPE};%{DATA:ID1};%{NUMBER:ID2};%{GREEDYDATA:DESCRIPTION}"] }
  }
  if ([DESCRIPTION] =~ "CODE")
  {
    grok
    {
      match => { "DESCRIPTION" => ["%{NUMBER:CODE_RETOUR}"] }
    }
  }
  if ([ID2] == "000003")
  {
    grok
    {
      match => { "DESCRIPTION" => ["%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:reste}"] }
    }
  }
  if ([TYPE] == "INFO")
  {
    if ([ID2] != "000003" and [ID2] != "000005")
    {
      if ([DESCRIPTION] !~ "info BDD" and [DESCRIPTION] !~ "CODE RETOUR")
      {
        drop { }
      }
    }
  }
  date
  {
    match => ["DATE_BATCH", "yyyyMMdd"]
  }
}
output
{
# elasticsearch
# {
# hosts => "http://localhost:9200"
# index => "gestapplicationna"
# }
    file 
    {
        path => "./test-%{+YYYY-MM-dd}.txt"
        codec => {
          line {
            format => "%{DESCRIPTION}"
          }
       }
    }
}

```

I want to have only the "DESCRIPTION" field in the created log file but my output section doesn't work. This is the error msg when i try to --config.test\_and\_exit

```
[FATAL] 2018-06-14 13:53:13.873 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, => at line 53, column 16 (byte 967) after output
{
# elasticsearch
# {
# hosts => "http://localhost:9200"
# index => "gestapplicationna"
# }
    file {
        path => "./test-%{+YYYY-MM-dd}.txt"
        codec => {
          line
[ERROR] 2018-06-14 13:53:13.877 [LogStash::Runner] Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit

```

Can somebody help me ?

Thx u

---

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [June 14, 2018, 12:10pm UTC](https://discuss.elastic.co/t/send-logstash-events-to-log-file-problem/135908/2 "2018-06-14T12:10:23Z")

</div>

SOLVED, correct syntax :

```
file {
            codec => line {
                    format => "%{[DESCRIPTION]}"
            }
            path => "./test-%{+YYYY-MM-dd}.txt"
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2018, 12:10pm UTC](https://discuss.elastic.co/t/send-logstash-events-to-log-file-problem/135908/3 "2018-07-12T12:10:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.