# While restarting logstash service , Getting error **URL:** \ **Category:** Logstash\ **Created:** [June 1, 2018, 7:02am UTC](https://discuss.elastic.co/t/while-restarting-logstash-service-getting-error/134153 "2018-06-01T07:02:03Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\ **Post date:** [June 1, 2018, 7:02am UTC](https://discuss.elastic.co/t/while-restarting-logstash-service-getting-error/134153/1 "2018-06-01T07:02:03Z")
While starting my logstash service, i'm getting below error please help. /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 76, column 17 (byte 2757) after filter {\n if [type] == "cflogs" {\n grok {\n match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} (?:-|%{INT:elb\_status\_code:int}) (?:-|%{INT:backend\_status\_code:int}) %{INT:received\_bytes:int} %{INT:sent\_bytes:int} \"%{ELB\_REQUEST\_LINE}\" \"(?:-|%{DATA:user\_agent})\" (?:-|%{NOTSPACE:ssl\_cipher}) (?:-|%{NOTSPACE:ssl\_protocol})"]\n }\n date {\n locale =\> "en"\n match =\> ["timestamp", "d/MMM/YYYY:HH:mm:ss Z"]\n }\n # these will ensure we have a valid index even if there are upper case letters in elb names\n mutate {\n add\_field =\> { "indexname" =\> "cf-%{cf}" }\n }\n mutate {\n lowercase =\> ["indexname"]\n }\n }\n\n if [type] == "elblogs" {\n grok {\n match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} (?:-|%{INT:elb\_status\_code:int}) (?:-|%{INT:backend\_status\_code:int}) %{INT:received\_bytes:int} %{INT:sent\_bytes:int} \"%{ELB\_REQUEST\_LINE}\" \"(?:-|%{DATA:user\_agent})\" (?:-|%{NOTSPACE:ssl\_cipher}) (?:-|%{NOTSPACE:ssl\_protocol})"]\n }\n date {\n locale =\> "en"\n match =\> ["timestamp", "d/MMM/YYYY:HH:mm:ss Z"]\n }\n # these will ensure we have a valid index even if there are upper case letters in elb names\n mutate {\n add\_field =\> { "indexname" =\> "elb-%{elb}" }\n }\n mutate {\n lowercase =\> ["indexname"]\n }\n }\n\n if [type] == "buildlogs" {\n grok {\n match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }\n }\n date {\n match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]\n }\n mutate {\n add\_field =\> { "indexname" =\> "builds-%{builds}" }\n\t}\n mutate {\n lowercase =\> ["indexname"]\n }\n}\noutput {\n elasticsearch ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]} My config file is as below. input { beats { type =\> "buildLogs" port =\> "5044" } s3 { bucket =\> "fcalb-logs" prefix =\> "qa-alb/AWSLogs/155086999298/elasticloadbalancing/" region =\> "us-east-1" type =\> "elblogs" codec =\> plain secret\_access\_key =\> "sdfsfsdfsfsfds" access\_key\_id =\> "sfsfsfsfsfsf" } s3 { bucket =\> "fcalb-logs" prefix =\> "cf-logs/" region =\> "us-east-1" type =\> "cflogs" codec =\> plain secret\_access\_key =\> "fdggfdgdgdgd" access\_key\_id =\> "sdggdfgdgf" } } filter { if [type] == "cflogs" { grok { match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} (?:-|%{INT:elb\_status\_code:int}) (?:-|%{INT:backend\_status\_code:int}) %{INT:received\_bytes:int} %{INT:sent\_bytes:int} "%{ELB\_REQUEST\_LINE}" "(?:-|%{DATA:user\_agent})" (?:-|%{NOTSPACE:ssl\_cipher}) (?:-|%{NOTSPACE:ssl\_protocol})"] } date { locale =\> "en" match =\> ["timestamp", "d/MMM/YYYY:HH:mm:ss Z"] } # these will ensure we have a valid index even if there are upper case letters in elb names mutate { add\_field =\> { "indexname" =\> "cf-%{cf}" } } mutate { lowercase =\> ["indexname"] } } if [type] == "elblogs" { grok { match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} (?:-|%{INT:elb\_status\_code:int}) (?:-|%{INT:backend\_status\_code:int}) %{INT:received\_bytes:int} %{INT:sent\_bytes:int} "%{ELB\_REQUEST\_LINE}" "(?:-|%{DATA:user\_agent})" (?:-|%{NOTSPACE:ssl\_cipher}) (?:-|%{NOTSPACE:ssl\_protocol})"] } date { locale =\> "en" match =\> ["timestamp", "d/MMM/YYYY:HH:mm:ss Z"] } # these will ensure we have a valid index even if there are upper case letters in elb names mutate { add\_field =\> { "indexname" =\> "elb-%{elb}" } } mutate { lowercase =\> ["indexname"] } } if [type] == "buildlogs" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } date { match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } mutate { add\_field =\> { "indexname" =\> "builds-%{builds}" } } mutate { lowercase =\> ["indexname"] } } output { elasticsearch { hosts =\> ["localhost:9200"] } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 1, 2018, 7:04am UTC](https://discuss.elastic.co/t/while-restarting-logstash-service-getting-error/134153/2 "2018-06-01T07:04:27Z")
I can't spot anything by quickly scanning the configuration. I suggest you comment out portions of the file to narrow things down. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 1, 2018, 7:30am UTC](https://discuss.elastic.co/t/while-restarting-logstash-service-getting-error/134153/3 "2018-06-01T07:30:14Z")
> [@Suresh\_Pal](#): > > if [type] == "cflogs" { > grok { > match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request\_processing\_time:float} %{NUMBER:backend\_processing\_time:float} %{NUMBER:response\_processing\_time:float} (?:-|%{INT:elb\_status\_code:int}) (?:-|%{INT:backend\_status\_code:int}) %{INT:received\_bytes:int} %{INT:sent\_bytes:int} "%{ELB\_REQUEST\_LINE}" "(?:-|%{DATA:user\_agent})" (?:-|%{NOTSPACE:ssl\_cipher}) (?:-|%{NOTSPACE:ssl\_protocol})"] > } It looks like you have a few unescaped `"` around the `ELB_REQUEST_LINE` block. Not sure if you are looking to have several patterns or match quotes in the message. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 29, 2018, 7:30am UTC](https://discuss.elastic.co/t/while-restarting-logstash-service-getting-error/134153/4 "2018-06-29T07:30:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.