# Unrecognized token 'CONNECTION\_LOST

**URL:** <https://discuss.elastic.co/t/unrecognized-token-connection-lost/46319>\
**Category:** Logstash\
**Created:** [April 5, 2016, 3:23am UTC](https://discuss.elastic.co/t/unrecognized-token-connection-lost/46319 "2016-04-05T03:23:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Farouk\_Samu](https://avatars.discourse-cdn.com/v4/letter/f/9e8a1a/32.png) [@Farouk\_Samu](https://discuss.elastic.co/u/Farouk_Samu)\
**Post date:** [April 5, 2016, 3:23am UTC](https://discuss.elastic.co/t/unrecognized-token-connection-lost/46319/1 "2016-04-05T03:23:35Z")

</div>

This is my logstash config file, after running it I got the below error

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} [%{WORD:text},%{NUMBER:num},%{IPV4:attack\_src}]\s\*[%{GREEDYDATA:username}][%{WORD:password}] -\s\*%{GREEDYDATA:rest}" }  
}

```
mutate {
    gsub => ["rest", "'", '"']
    gsub => ["rest", "False", "false"]
}

json {
    source => "rest"
}

mutate {
    remove_field => ["rest", "message"]
}

```

}

output {  
elasticsearch {  
host =\> ["localhost:9200"]  
protocol =\> http  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

ERROR:

Trouble parsing json {:source=\>"rest", :raw=\>"CONNECTION\_LOST", :exception=\>#\<LogStash::Json::ParserError: Unrecognized token 'CONNECTION\_LOST': was expecting ('true', 'false' or 'null')  
at [Source: [B@1e93758; line: 1, column: 31]\>, :level=\>:warn}  
Trouble parsing json {:source=\>"rest", :raw=\>"CONNECTION\_LOST", :exception=\>#\<LogStash::Json::ParserError: Unrecognized token 'CONNECTION\_LOST': was expecting ('true', 'false' or 'null')  
at [Source: [B@a54131; line: 1, column: 31]\>, :level=\>:warn}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2016, 4:00am UTC](https://discuss.elastic.co/t/unrecognized-token-connection-lost/46319/2 "2016-04-05T04:00:13Z")

</div>

Please keep it to the one thread - [Logstash-filebeat error](https://discuss.elastic.co/t/logstash-filebeat-error/46315)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 5, 2016, 4:00am UTC](https://discuss.elastic.co/t/unrecognized-token-connection-lost/46319/3 "2016-04-05T04:00:16Z")

</div>

Closed on April 5, 2016, 4:00am UTC