The given configuration is invalid. Reason: Expected one of #

Elastic Stack Logstash
1

Hi all,

I am following this link (Link) to display live weather data on Kibana.

I used the logstash configuration explained in the pdf.

Here is my logstash configuration

input {
  exec {
    command => "curl --silent -L ’http://api.openweathermap.org/data/2.5/weather?id=5490223&APPID="API_KEY"&units=metric’"
    codec => "json"
    interval => 600
  }
}
filter {
  mutate {
    remove field => ["@version" ,"command" ,"host" ,"cod" ,"id" ,"base" ,"coord" ,"sys" ,"dt"]
  }
  split { field => "weather" }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "weather-%{+YYYY.MM.dd}"
  }
}

When I execute the command

.\logstash -f weather_data.conf --config.test_and_exit

I get an error that reads like this

Sending Logstash's logs to E:/elk/logstash/logs which is now configured via log4j2.properties
[2018-07-17T15:28:42,202][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-17T15:28:42,976][FATAL][logstash.runner          ] The given configuration is invalid. Reason: Expected one of #, => at line 10, column 12 (byte 241) after filter {
  mutate {
    remove
[2018-07-17T15:28:42,995][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

What's wrong with the configuration? Request to please help me out here. Thanks in advance!

2

should be remove_field

3

Thanks!

Seems like logstash is running

Successfully started Logstash API endpoint {:port=>9600}

But, I don't see a new index in Elasticsearch

On the browser, I navigated to

http://localhost:9200/_cat/indices

This is the output I got,

Capture
Capture980×316 22 KB

What do I have to do now? I don't see any index that begins with weather-*.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.