# Unable to parse specific log with logstash 6.3

**URL:** <https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301>\
**Category:** Logstash\
**Created:** [July 10, 2018, 8:52am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301 "2018-07-10T08:52:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Loudone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loudone/32/33365_2.png) [@Loudone](https://discuss.elastic.co/u/Loudone)\
**Post date:** [July 10, 2018, 8:52am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/1 "2018-07-10T08:52:18Z")

</div>

Dear all,

I'm new on logstash, and I'm trying to parse this log with logstash:

2018-07-10T10:46:25+0200 coll\_bddf [3] [0] [6] [24] [2] [5]

so, I've create the logstash configuration file below:

input {  
file {  
path =\> "/var/log/logstash/SOLR\_LOGS/Solr\_generate\_1.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{USERNAME:collection-name} [%{INT:global\_time}] [%{INT:num\_docs}] [%{INT:creation\_time}] [%{INT:commit\_time}] [%{INT:search\_time}] [%{INT:delete\_time}]" }  
overwrite =\> [“message”]  
}  
}

output {  
elasticsearch{  
hosts =\> ["192.168.186.120:9200"]  
cluster =\> "elasticsearch"  
protocol =\> "http"  
index =\> "solrcollbddf-%{+YYYY.MM.dd}"  
stdout { codec =\> rubydebug }  
}  
}

but, when I trying to run logstash, I receive this kind of error:

[2018-07-10T10:26:17,981][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, ", ', -, [, {,] at line 12, column 15 (byte 393) after filter {\ngrok {\nmatch =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{USERNAME:collection-name} \[%{INT:global\_time}\] \[%{INT:num\_docs}\] \[%{INT:creation\_time}\] \[%{INT:commit\_time}\] \[%{INT:search\_time}\] \[%{INT:delete\_time}\]" }\noverwrite =\> [", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]}  
[2018-07-10T10:26:18,519][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

Could you Help me to resolve this issue?

Many Thanks for your help

Kind regards

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 10, 2018, 9:29am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/2 "2018-07-10T09:29:45Z")

</div>

> [@Loudone](#):
>
> cluster =\> "elasticsearch"  
> protocol =\> "http"

These two parameters are no longer supported. See the [docs](https://www.elastic.co/guide/en/logstash-versioned-plugins/current/v9.2.0-plugins-outputs-elasticsearch.html) for a list of supported configuration parameters.

> [@Loudone](#):
>
> stdout { codec =\> rubydebug }

This is a separate plugin and can not be specified within the elasticsearch plugin.

---

<div class="post-metadata">

**Author:** ![Loudone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loudone/32/33365_2.png) [@Loudone](https://discuss.elastic.co/u/Loudone)\
**Post date:** [July 10, 2018, 10:09am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/3 "2018-07-10T10:09:48Z")

</div>

Christian,

Many thanks for your feed back.

So, I removed the parameters, and now my conf is like that:

input {  
file {  
path =\> "/var/log/logstash/SOLR\_LOGS/Solr\_generate\_1.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{USERNAME:collection-name} [%{INT:global\_time}] [%{INT:num\_docs}] [%{INT:creation\_time}] [%{INT:commit\_time}] [%{INT:search\_time}] [%{INT:delete\_time}]" }  
overwrite =\> [“message”]  
}  
}

output {  
elasticsearch{  
hosts =\> ["192.168.186.120:9200"]  
index =\> "solrcollbddf-%{+YYYY.MM.dd}"  
}  
}

But, I'm still have an issue, the error is:

[2018-07-10T12:05:54,634][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, ", ', -, [, {,] at line 12, column 15 (byte 393) after filter {\ngrok {\nmatch =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{USERNAME:collection-name} \[%{INT:global\_time}\] \[%{INT:num\_docs}\] \[%{INT:creation\_time}\] \[%{INT:commit\_time}\] \[%{INT:search\_time}\] \[%{INT:delete\_time}\]" }\noverwrite =\> [", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]}  
[2018-07-10T12:05:55,416][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

The problem seems to be at the filter step, but I did it with an inline grok debugger and it give a correct response.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 10, 2018, 10:37am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/4 "2018-07-10T10:37:51Z")

</div>

> [@Loudone](#):
>
> overwrite =\> [“message”]

Check that you have proper quotation marks here. The config isn't formatted properly, so it is hard to tell what is wrong.

---

<div class="post-metadata">

**Author:** ![Loudone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loudone/32/33365_2.png) [@Loudone](https://discuss.elastic.co/u/Loudone)\
**Post date:** [July 10, 2018, 11:30am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/5 "2018-07-10T11:30:08Z")

</div>

Christian, many thanks it's working fine!! the quotation marks were wrong!! I replaced them, an now is working properly!!  
The topic can be closed!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2018, 11:30am UTC](https://discuss.elastic.co/t/unable-to-parse-specific-log-with-logstash-6-3/139301/6 "2018-08-07T11:30:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.