# Simple config file but fail to start

**URL:** <https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121>\
**Category:** Logstash\
**Created:** [December 3, 2018, 8:56am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121 "2018-12-03T08:56:44Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 3, 2018, 8:56am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/1 "2018-12-03T08:56:44Z")

</div>

Here is my config file, but logstash won't start.

input {  
file {  
path =\> ["c:/tmp/elk/logs/Rtp\*"]  
type =\> "cfxlog"  
}  
}

filter {  
grok {  
match =\> {"message" =\> "%{URIHOST:date1} %{HAPROXYTIME:time1} %{GREEDYDATA:unknownumber} %{GREEDYDATA:type} %{QS:message}" }  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

error:

C:\tmp\elk\log\bin\>logstash.bat -f t0.conf  
Picked up \_JAVA\_OPTIONS: -Djava.net.preferIPv4Stack=true  
Sending Logstash logs to C:/tmp/elk/log/logs which is now configured via log4j2.properties  
[2018-12-03T16:54:20,713][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2018-12-03T16:54:20,742][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.5.1"}  
[2018-12-03T16:54:21,499][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, input, filter, output at line 1, column 1 (byte 1) after ", :backtrace=\>["C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline\_action/create.rb:42:in `block in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:in`block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:in`exclusive'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:317:in`block in converge\_state'"]}  
[2018-12-03T16:54:21,947][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

really getting headache. Thanks a lot

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [December 3, 2018, 9:48am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/2 "2018-12-03T09:48:54Z")

</div>

Are you sure you are running the correct file? Its complaining about the very first character in the line. Are you using the full absolute path to the config file?

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 3, 2018, 9:59am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/3 "2018-12-03T09:59:10Z")

</div>

thanks for reply, I tested with full path, still fail. same error  
logstash.bat -f C:\tmp\elk\log\bin\t0.conf

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [December 3, 2018, 9:59am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/4 "2018-12-03T09:59:54Z")

</div>

Did you copy and paste the config from somewhere else? Perhaps it has inadvertly added some characters to the start of the file

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 3, 2018, 10:05am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/5 "2018-12-03T10:05:42Z")

</div>

might be it works now.

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 4, 2018, 12:56am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/6 "2018-12-04T00:56:37Z")

</div>

thanks a lot for your help.  
I copy and paste the content to another file the it works. might related to file format(UTF8?).

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [December 4, 2018, 9:42am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/7 "2018-12-04T09:42:11Z")

</div>

Good to hear! Please mark as solution if fixed!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2019, 9:42am UTC](https://discuss.elastic.co/t/simple-config-file-but-fail-to-start/159121/8 "2019-01-01T09:42:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.