# Syntax error with filter

**URL:** <https://discuss.elastic.co/t/syntax-error-with-filter/192162>\
**Category:** Logstash\
**Created:** [July 25, 2019, 4:47am UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162 "2019-07-25T04:47:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)\
**Post date:** [July 25, 2019, 4:47am UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162/1 "2019-07-25T04:47:55Z")

</div>

Hello,  
I'm use logstash for parser some postgress log's. But my filter section says syntax error:

```auto
[2019-07-25T00:08:47,536][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.8.1"}
[2019-07-25T00:08:52,138][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ,, ] at line 12, column 30 (byte 222) after filter {\n grok {\n patterns_dir => [\"/etc/logstash/patterns\"]\n match => [\"message\" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}
[2019-07-25T00:08:53,660][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2019-07-25T00:08:57,889][INFO][logstash.runner] Logstash shut down.

```

And my setting is:

```auto
input {
  file {
    path => "/var/lib/pgsql/9.6/data/pg_log/postgresql.log"
    start_position => "beginning"
  }
}

filter {
  grok {
        patterns_dir => ["/etc/logstash/patterns"]
        match => ["message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:Timezone} %{SYSLOGHOST:source} %{GREEDYDATA:message}"]
    }
}

output {
  elasticsearch {
    hosts => ["http://192.168.0.20:9200"]
    index => "pgsql-%{+YYYY.MM.dd}"
    }
    stdout {
        codec => "rubydebug"
   }
}

```

don't see the error -\_- . ¿can you help me?

Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 25, 2019, 5:03am UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162/2 "2019-07-25T05:03:45Z")

</div>

The match statement in your grok filter should have curly braces around the message part. See [the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) for an example.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 1:25pm UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162/3 "2019-07-25T13:25:34Z")

</div>

> [@mcoa](#):
>
> match =\> [ "message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp}

logstash is fairly flexible about allowing arrays where it expects hashes and vice versa, but if you use an array (i.e. square brackets) then you must use comma, not =\>, as a separator. This should be

```
match => { "message" => "...

```

---

<div class="post-metadata">

**Author:** ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)\
**Post date:** [July 25, 2019, 1:50pm UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162/4 "2019-07-25T13:50:10Z")

</div>

uffff,,, thanks. solved

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2019, 1:50pm UTC](https://discuss.elastic.co/t/syntax-error-with-filter/192162/5 "2019-08-22T13:50:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.