# \[SOLVED\]Logstash configuration problem identification

**URL:** <https://discuss.elastic.co/t/solved-logstash-configuration-problem-identification/146739>\
**Category:** Logstash\
**Created:** [August 30, 2018, 3:50pm UTC](https://discuss.elastic.co/t/solved-logstash-configuration-problem-identification/146739 "2018-08-30T15:50:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [August 30, 2018, 3:50pm UTC](https://discuss.elastic.co/t/solved-logstash-configuration-problem-identification/146739/1 "2018-08-30T15:50:32Z")

</div>

Hello .  
I cannot figure out the problem in this configuration I have created:

**I get error:**

> [2018-08-30T17:43:41,301][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:cybercrime\_tracker, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 30, column 19 (byte 1002) after filter {\n split {\n field =\> "[message]"\n }\n if ([message] =~ /^#/) {\n drop{}\n }\n else {\n grok {\n match =\> { "message" =\> "^%{URI:url}" }\n }\n }\n\n\noutput {\n elasticsearch ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in `block in converge\_state'"]}

**My pipeline config:**

> cat pipelines.yml | grep cybercrime\_tracker -A 3
> 
> - pipeline.id: cybercrime\_tracker  
> path.config: "/etc/logstash/conf.d/cybercrime.conf"  
> pipeline.workers: 16

**My cybercrime.conf**

> input {  
> http\_poller {  
> urls =\> {  
> cybercrime\_tracker\_all =\> "[http://cybercrime-tracker.net/all.php](http://cybercrime-tracker.net/all.php)"  
> }  
> request\_timeout =\> 30  
> tags =\> ["cybercrime", "url"]  
> codec =\> "line"  
> validate\_after\_inactivity =\> 200  
> schedule =\> { cron =\> "\*/50 \* \* \* \*" }  
> metadata\_target =\> "metadata"  
> }  
> }
> 
> filter {  
> split {  
> field =\> "[message]"  
> }  
> if ([message] =~ /^#/) {  
> drop{}  
> }  
> else {  
> grok {  
> match =\> { "message" =\> "^%{URI:url}" }  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> index =\> "blocks"  
> document\_type =\> "default"  
> }  
> }

**File content looks like:**  
[futoimtelibrary.com/Godfirst/panelnew/admin.php](http://futoimtelibrary.com/Godfirst/panelnew/admin.php)  
www.emeka.igg.biz/ems/admin.php  
[lydiasimoncreative.com/.css/cp.php?m=login](http://lydiasimoncreative.com/.css/cp.php?m=login)

> **[TODDLY TOTS](https://www.toddlytots.com/password)**

terriblekira.su/uk/  
[veraceforneria.com/test/home/sjdhf/server/cp.php?m=login](http://veraceforneria.com/test/home/sjdhf/server/cp.php?m=login)  
[viewtoconfirm.com/marchit/Panel/admin.php](http://viewtoconfirm.com/marchit/Panel/admin.php)  
www.ecostore.co.il/shell/123.php  
[hoiyhead.co.uk/images/php/suz/admin.php](http://hoiyhead.co.uk/images/php/suz/admin.php)  
[hoiyhead.co.uk/images/php/suz1/admin.php](http://hoiyhead.co.uk/images/php/suz1/admin.php)  
[hoiyhead.co.uk/images/php/suz2/admin.php](http://hoiyhead.co.uk/images/php/suz2/admin.php)  
[hoiyhead.co.uk/images/php/suz3/admin.php](http://hoiyhead.co.uk/images/php/suz3/admin.php)  
[hoiyhead.co.uk/images/php/suz4/admin.php](http://hoiyhead.co.uk/images/php/suz4/admin.php)  
[hoiyhead.co.uk/images/php/edd/admin.php](http://hoiyhead.co.uk/images/php/edd/admin.php)  
[hoiyhead.co.uk/images/php/eno/admin.php](http://hoiyhead.co.uk/images/php/eno/admin.php)  
[hoiyhead.co.uk/images/php/law/admin.php](http://hoiyhead.co.uk/images/php/law/admin.php)  
[hoiyhead.co.uk/images/php/maza/admin.php](http://hoiyhead.co.uk/images/php/maza/admin.php)  
[hoiyhead.co.uk/images/php/oge/admin.php](http://hoiyhead.co.uk/images/php/oge/admin.php)

What is the problem? Thanks for suggestions.

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [August 30, 2018, 3:53pm UTC](https://discuss.elastic.co/t/solved-logstash-configuration-problem-identification/146739/2 "2018-08-30T15:53:40Z")

</div>

Missed } in the filter plugin.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 3:53pm UTC](https://discuss.elastic.co/t/solved-logstash-configuration-problem-identification/146739/3 "2018-09-27T15:53:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.