Simple config file but fail to start

Here is my config file, but logstash won't start.

input {
file {
path => ["c:/tmp/elk/logs/Rtp*"]
type => "cfxlog"
}
}

filter {
grok {
match => {"message" => "%{URIHOST:date1} %{HAPROXYTIME:time1} %{GREEDYDATA:unknownumber} %{GREEDYDATA:type} %{QS:message}" }
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

error:

C:\tmp\elk\log\bin>logstash.bat -f t0.conf
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
Sending Logstash logs to C:/tmp/elk/log/logs which is now configured via log4j2.properties
[2018-12-03T16:54:20,713][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-12-03T16:54:20,742][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.1"}
[2018-12-03T16:54:21,499][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace=>["C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:42:in block in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in synchronize'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:inexclusive'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:317:inblock in converge_state'"]}
[2018-12-03T16:54:21,947][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}

really getting headache. Thanks a lot

Are you sure you are running the correct file? Its complaining about the very first character in the line. Are you using the full absolute path to the config file?

thanks for reply, I tested with full path, still fail. same error
logstash.bat -f C:\tmp\elk\log\bin\t0.conf

Did you copy and paste the config from somewhere else? Perhaps it has inadvertly added some characters to the start of the file

might be it works now.

thanks a lot for your help.
I copy and paste the content to another file the it works. might related to file format(UTF8?).

Good to hear! Please mark as solution if fixed!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.