Simple config file but fail to start


(James Pang) #1

Here is my config file, but logstash won't start.

input {
file {
path => ["c:/tmp/elk/logs/Rtp*"]
type => "cfxlog"
}
}

filter {
grok {
match => {"message" => "%{URIHOST:date1} %{HAPROXYTIME:time1} %{GREEDYDATA:unknownumber} %{GREEDYDATA:type} %{QS:message}" }
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

error:

C:\tmp\elk\log\bin>logstash.bat -f t0.conf
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
Sending Logstash logs to C:/tmp/elk/log/logs which is now configured via log4j2.properties
[2018-12-03T16:54:20,713][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-12-03T16:54:20,742][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.1"}
[2018-12-03T16:54:21,499][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace=>["C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}
[2018-12-03T16:54:21,947][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

really getting headache. Thanks a lot


(Lewis Barclay) #2

Are you sure you are running the correct file? Its complaining about the very first character in the line. Are you using the full absolute path to the config file?


(James Pang) #3

thanks for reply, I tested with full path, still fail. same error
logstash.bat -f C:\tmp\elk\log\bin\t0.conf


(Lewis Barclay) #4

Did you copy and paste the config from somewhere else? Perhaps it has inadvertly added some characters to the start of the file


(James Pang) #5

might be it works now.


(James Pang) #6

thanks a lot for your help.
I copy and paste the content to another file the it works. might related to file format(UTF8?).


(Lewis Barclay) #7

Good to hear! Please mark as solution if fixed!