What is wrong with my logstash config?

[andre22]

Hi,

Logstash complains that this config file is wrong, but I don't see where:

input { 
  beats {
    port => 5044
  }
}
filter {
  if "knxmonitor" in [tags] {
    grok {
      match => { "message" => "\A%{TIMESTAMP_ISO8601:eventtime};%{NOTSPACE};%{CRON_ACTION:abc}" }
    }
  }
output {
  elasticsearch { hosts => [ "localhost:9200" ] }
}

I checked for wrong spaces and so on - nothing. This is the error I am receiving:

[2017-03-17T22:25:36,832][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Expected one of #, => at line 13, column 17 (byte 226) after filter {\n if "knxmonitor" in [tags] {\n grok {\n match => { "message" => "\A%{TIMESTAMP_ISO8601:eventtime};%{NOTSPACE};%{CRON_ACTION:abc}" }\n }\n }\noutput {\n elasticsearch "}

[theuntergeek (Aaron Mildenstein)]

You need one more } at the end of your filter block, right before the word output. Count the closing and opening curly braces.

[andre22]

I realised it in the exact second. What a shame

thanks a lot!