# Unable to resolve error-Logstash .conf file(CentOS 7 Linux) **URL:** \ **Category:** Logstash\ **Created:** [July 10, 2018, 3:37pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390 "2018-07-10T15:37:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sdubbudu](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sdubbudu](https://discuss.elastic.co/u/sdubbudu)\ **Post date:** [July 10, 2018, 3:37pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/1 "2018-07-10T15:37:25Z")
Hi all I have recently started using the Elastic Stack. I have everything up and running. But when I try to create pipeline I get a very weird error which I dont find any where in my logstash .conf file I am posting below. LOGSTASH CONF FILE input{ beats{ port =\> 5044 host =\> "localhost" } } filter{ grok { match =\> { "message" =\> " %{NUMBER:pid} %{SYSLOGHOST:user} %{NUMBER:priority} %{NUMBER:nice\_value} %{NUMBER:virtual\_memory} %{NUMBER:physical\_memory} %{NUMBER:shared\_memory} %{WORD:status} %{NUMBER:cpu\_usage} %{NUMBER:ram\_usage} %{TIME:activity\_time} %{WORD:command}/n } } } output{ stdout{ codec =\> rubydebug } elasticsearch { hosts =\> localhost manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } Error From the Logs: [ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 17, column 15 (byte 487) after filter{\n grok {\n match =\> { "message" =\> " %{NUMBER:pid} %{SYSLOGHOST:user} %{NUMBER:priority} %{NUMBER:nice\_value} %{NUMBER:virtual\_memory} %{NUMBER:physical\_memory} %{NUMBER:shared\_memory} %{WORD:status} %{NUMBER:cpu\_usage} %{NUMBER:ram\_usage} %{TIME:activity\_time} %{WORD:command}/n }\n }\n}\noutput{\n stdout{ codec =\> rubydebug }\n elasticsearch { \n hosts =\> localhost\n manage\_template =\> false\n index =\> "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 10, 2018, 3:51pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/2 "2018-07-10T15:51:34Z")
You are missing a " on the grok pattern, so it thinks everything down to index =\> " is part of the pattern. ---
**Author:** ![sdubbudu](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sdubbudu](https://discuss.elastic.co/u/sdubbudu)\ **Post date:** [July 10, 2018, 4:06pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/3 "2018-07-10T16:06:35Z")
Thanks for that!! Feels stupid now, guess I was looking at the wrong place. Hope that works. ---
**Author:** ![sdubbudu](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sdubbudu](https://discuss.elastic.co/u/sdubbudu)\ **Post date:** [July 10, 2018, 8:20pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/4 "2018-07-10T20:20:09Z")
Can you please help me parse the event structure(It's just the output of top command) PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 127936 3808 2316 S 5.3 0.2 0:05.29 systemd The first line shows the fields that we name the structure as, second line the samples. I tried to use the one i showed up here or several other mutated versions with no effect. Thank you ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 10, 2018, 8:39pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/5 "2018-07-10T20:39:30Z")
That time does not match the TIME pattern. You could try (?\[0-9:\.]+) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 7, 2018, 8:39pm UTC](https://discuss.elastic.co/t/unable-to-resolve-error-logstash-conf-file-centos-7-linux/139390/6 "2018-08-07T20:39:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.