# Trouble with logstash pipeline creating es index
**URL:** https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397
**Category:** Logstash
**Created:** [July 23, 2020, 8:10pm UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397 "2020-07-23T20:10:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jwade](https://discuss.elastic.co/u/jwade)
#### Post date: [July 23, 2020, 8:10pm UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/1 "2020-07-23T20:10:18Z")
I am attempting to ingest this logfile:
```auto
---,36.25, 30.14, 0.01, 0.01, 26.36, 23.92, 23.68
---,36.25, 30.15, 0.01, 0.01, 26.36, 24.04, 23.68
---,36.26, 30.14, 0.01, 0.01, 26.36, 24.04, 23.68
---,36.25, 30.15, 0.01, 0.01, 26.36, 24.04, 23.68
---,36.25, 30.15, 0.01, 0.01, 26.36, 24.04, 23.55
---,36.26, 30.15, 0.01, 0.01, 26.36, 24.04, 23.68
---,36.25, 30.14, 0.01, 0.01, 26.24, 23.92, 23.55
```
And using this conf file:
```auto
input {
file {
path => "c:\\users\\administrator\\desktop\\bsb1_data_output1.txt"
start_position => "beginning"
}
}
filter {
grok {
match => "%{GREEDYDATA}"
}
}
}
output {
elasticsearch {
hosts => "http://myIP:9200"
index => "bsb1"
document_type => "bsb1"
}
}
stdout {
codec => rubydebug
}
}
```
But I get this error:
`[FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)`
Can someone please help me figure this out? 🙂
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 23, 2020, 8:17pm UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/2 "2020-07-23T20:17:38Z")
Here's a list of things to check:
>
Edit: And the grok match parameter should be a hash defining both the target field and the pattern. You only wrote down the pattern and a bracket. So maybe that's the problem.
Edit 2: And the stdout is outside of the output blog and has another unmatched bracket. It looks like you copied together some snippets without checking your syntax?
---
### Author:  [@jwade](https://discuss.elastic.co/u/jwade)
#### Post date: [July 23, 2020, 8:35pm UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/3 "2020-07-23T20:35:39Z")
Thanks, Jenni. Yep, I am new to logstash pipelines and trying to put this together as I am reading about it/learning.
---
### Author:  [@jwade](https://discuss.elastic.co/u/jwade)
#### Post date: [July 24, 2020, 5:19pm UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/4 "2020-07-24T17:19:13Z")
I have updated my pipeline conf file, but logstash starts with the default template and does not create the es index. Any help would be greatly appreciated.
```auto
input {
file {
path => "C:/Users/Adminstrator/Desktop/bsb2_data_output.txt"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
grok {
match => ["message" , "%---,%{URIHOST},%{BASE16FLOAT},%{BASE16FLOAT},%{BASE16FLOAT},%{BASE16FLOAT},%{BASE16FLOAT},%{BASE16FLOAT}"]
}
}
output {
elasticsearch {
hosts => "http://myIP:9200"
index => "logstash-bsb2"
}
}
```
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 25, 2020, 11:31am UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/5 "2020-07-25T11:31:02Z")
I could see few issues in your grok pattern (may be its the data you copied have extra spaces?)
Try testing your grok and data in : [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
Please find sample and see if it works
Data sample
```auto
---,36.25, 30.14, 0.01, 0.01, 26.36, 23.92, 23.68
---,36.24, 20.14, 2.01, 4.01, 36.36, 43.92, 53.68
```
processor
```auto
input {
file {
path => "/tmp/samplefile.txt"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
grok {
match => {
message => "^\s*---,%{BASE16FLOAT:field1},\s*%{BASE16FLOAT:field2},\s*%{BASE16FLOAT:field3},\s*%{BASE16FLOAT:field4},\s*%{BASE16FLOAT:field5},\s*%{BASE16FLOAT:field6}"
}
}
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "logstash-bsb2"
password => "changeme"
user => "elastic"
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2020, 11:31am UTC](https://discuss.elastic.co/t/trouble-with-logstash-pipeline-creating-es-index/242397/6 "2020-08-22T11:31:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.