# What is the propper way to create in logstash checkpoint filter **URL:** \ **Category:** Logstash\ **Created:** [May 18, 2021, 3:21pm UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309 "2021-05-18T15:21:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Enrique\_Pedroza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique_pedroza/32/87483_2.png) [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\ **Post date:** [May 18, 2021, 3:21pm UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/1 "2021-05-18T15:21:25Z")
I have a ELK stack in my server, in other pc i have filebeat listening for Checkpoint syslogs. I know i have to write the filters in a .conf file. This is mine : ```auto filter{ if "checkpoint-firewall" in [tags] { grok { match => [ "message" => "<%{POSINT:priority}>%{MONTH:mes}%{SPACE}%{MONTHDAY:dia}%{SPACE}%{HOUR:hora}:%{MINUTE:minuto}:%{SECOND:segundo}?%{ISO8601_TIMEZONE:zona_horaria}?%{SPACE}%{IP:host}{SPACE}%{WORD:}" ] } kv { source => "raw_message" value_split => '=\"' allow_duplicate_values => true } } } ``` But Logstash complains and dont recieve the Logs, what am i doing bad? EDIT, I found The Log: ```auto Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"{\", \",\", \"]\" at line 16, column 19 (byte 284) after filter{\n \n if \"checkpoint-firewall\" in [tags] {\n grok {\n match => [\n \"message\" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:389:in `block in converge_state'"]} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 18, 2021, 3:28pm UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/2 "2021-05-18T15:28:00Z")
> [@Enrique\_Pedroza](#): > > But Logstash complains What exactly is the error message? ---
**Author:** ![Enrique\_Pedroza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique_pedroza/32/87483_2.png) [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\ **Post date:** [May 18, 2021, 3:29pm UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/3 "2021-05-18T15:29:35Z")
there is not exactly an error, the CPU goes to 150 % of ussage and in Kibana i doesnt appear the information. In the logs it just goes normal ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 18, 2021, 5:13pm UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/4 "2021-05-18T17:13:40Z")
> [@Enrique\_Pedroza](#): > > ```auto > match => [ > "message" => "<%{POSINT:priority}>%{MONTH:mes}%{SPACE}%{MONTHDAY:dia}%{SPACE}%{HOUR:hora}:%{MINUTE:minuto}:%{SECOND:segundo}?%{ISO8601_TIMEZONE:zona_horaria}?%{SPACE}%{IP:host}{SPACE}%{WORD:}" > ] > > ``` That should be ``` match => { "message" => "<%{POSINT:priority}>%{MONTH:mes}%{SPACE}%{MONTHDAY:dia}%{SPACE}%{HOUR:hora}:%{MINUTE:minuto}:%{SECOND:segundo}?%{ISO8601_TIMEZONE:zona_horaria}?%{SPACE}%{IP:host}{SPACE}%{WORD:}" } ``` with {} instead of ---
**Author:** ![Enrique\_Pedroza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique_pedroza/32/87483_2.png) [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\ **Post date:** [May 19, 2021, 8:55am UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/5 "2021-05-19T08:55:21Z")
now it works , THANKS !, other question. Logstash acepts the log : ```auto [2021-05-19T08:29:50,708][DEBUG][logstash.filters.grok][main][fb358952f29e1e1ccd44ae271051e29ae564d49519648d285f66b1d3f3b955c0] Running grok filter {:event=>{"@timestamp"=>2021-05-19T08:29:49.446Z, "message"=>"<85>May 19 09:29:47+01:00 192.168.1.1 Action=\"accept\" inzone=\"Internal\" outzone=\"External\" service_id=\"HTTPS\" src=\"192.168.1.1\" dst=\"107.1.1.1\" proto=\"6\" xlatesrc=\"1.1.1.1\" xlatedst=\"\" NAT_rulenum=\"0\" NAT_addtnl_rulenum=\"0\" user=\"\" src_user_name=\"\" src_machine_name=\"\" src_user_dn=\"\" snid=\"\" dst_user_name=\"\" dst_machine_name=\"\" dst_user_dn=\"\" UP_match_table=\"TABLE_START\" ROW_START=\"0\" match_id=\"0\" layer_uuid=\"xxxxxxxxx\" layer_name=\"internal\" rule_uid=\"xxxxxxxx\" rule_name=\"Implied Rule \" ROW_END=\"0\" ROW_START=\"1\" match_id=\"xxxxxxx\" layer_uuid=\"xxxxxxx\" layer_name=\"Outgoing\" rule_uid=\"xxxxxx\" rule_name=\"Outgoing Default Policy\" ROW_END=\"1\" UP_match_table=\"TABLE_END\" gateway_id=\"xxxx" ProductName=\"xxxxx" svc=\"xx\" sport_svc=\"xxxx\" xlatedport_svc=\"\" xlatesport_svc=\"xxx\" ProductFamily=\"\" \n", "log"=>{"source"=>{"address"=>"1.1.1.1:xx"}}, "fileset"=>{"name"=>"firewall"}, "ecs"=>{"version"=>"x.x.x"}, "tags"=>["checkpoint-firewall", "forwarded", "beats_input_codec_plain_applied"], "service"=>{"type"=>"checkpoint"}, "event"=>{"dataset"=>"checkpoint.firewall", "timezone"=>"+0x:00", "module"=>"checkpoint"}, "@version"=>"1", "input"=>{"type"=>"udp"}, "agent"=>{"id"=>"xxxxx", "name"=>"xx-MV", "type"=>"filebeat", "version"=>"7.12.1", "hostname"=>"xxxx-MV", "ephemeral_id"=>"xxxxx"}}} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2021, 8:55am UTC](https://discuss.elastic.co/t/what-is-the-propper-way-to-create-in-logstash-checkpoint-filter/273309/6 "2021-06-16T08:55:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.