Simple config file but fail to start

Elastic Stack Logstash
1

Here is my config file, but logstash won't start.

input {
file {
path => ["c:/tmp/elk/logs/Rtp*"]
type => "cfxlog"
}
}

filter {
grok {
match => {"message" => "%{URIHOST:date1} %{HAPROXYTIME:time1} %{GREEDYDATA:unknownumber} %{GREEDYDATA:type} %{QS:message}" }
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

error:

C:\tmp\elk\log\bin>logstash.bat -f t0.conf
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
Sending Logstash logs to C:/tmp/elk/log/logs which is now configured via log4j2.properties
[2018-12-03T16:54:20,713][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-12-03T16:54:20,742][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.1"}
[2018-12-03T16:54:21,499][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace=>["C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}
[2018-12-03T16:54:21,947][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

really getting headache. Thanks a lot

2

Are you sure you are running the correct file? Its complaining about the very first character in the line. Are you using the full absolute path to the config file?

3

thanks for reply, I tested with full path, still fail. same error
logstash.bat -f C:\tmp\elk\log\bin\t0.conf

4

Did you copy and paste the config from somewhere else? Perhaps it has inadvertly added some characters to the start of the file

5

might be it works now.

6

thanks a lot for your help.
I copy and paste the content to another file the it works. might related to file format(UTF8?).

7

Good to hear! Please mark as solution if fixed!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.