# Winlogbeat to Logstash = Config file help required **URL:** \ **Category:** Logstash\ **Created:** [September 17, 2018, 12:02pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-config-file-help-required/148828 "2018-09-17T12:02:24Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![JKCode](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@JKCode](https://discuss.elastic.co/u/JKCode)\ **Post date:** [September 17, 2018, 12:02pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-config-file-help-required/148828/1 "2018-09-17T12:02:24Z")
Hi All, I am trying to set up Logstash to receive Winlogbeat input with Logstash config file with conditional redirect of output to specific elasticsearch indexing. Getting Configuration error; complete details below = ## Logstash Config File: ``` input{ beats { port => 5044 host => "0.0.0.0" } } output{ if [winlogbeats][event_logs][tags] == "Security_Log" { output{ elasticsearch { hosts => "localhost:9200" manage_template => false index => "SecLog-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } } else if [winlogbeats][event_logs][tags] == "System_Log" { output{ elasticsearch { hosts => "localhost:9200" manage_template => false index => "SysLog-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } } } ``` } ## Winlogbeat Config: ``` winlogbeat.registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml winlogbeat.event_logs: - name: Security ignore_older: 72h include_xml: true level: critical, error, warning, information, verbose tags: ["Security_Log"] - name: System ignore_older: 72h include_xml: true level: critical, error, warning, information, verbose tags: ["System_Log"] #==================== Elasticsearch template setting ========================== setup.template.settings: index.number_of_shards: 3 #================================ General ===================================== name: "WinLogsShipper:Sec&Sys" tags: ["WInLogsShipper-Sec&Sys"] #============================== Kibana ===================================== setup.kibana: host: "localhost:5601" #----------------------------- Logstash output -------------------------------- output.logstash: hosts: ["localhost:5044"] ``` ====== ## Error in cmd: ``` [2018-09-17T17:27:24,008][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:JK_System, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 30, column 27 (byte 857) after output{\n if [winlogbeats][event_logs][tags] == \"Security_Log\" {\n output{\n elasticsearch ", :backtrace=>["D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/agent.rb:309:in `block in converge_state'"]} [2018-09-17T17:27:24,010][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:JK_Security, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 30, column 27 (byte 857) after output{\n if [winlogbeats][event_logs][tags] == \"Security_Log\" {\n output{\n elasticsearch ", :backtrace=>["D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:38:in `execute'", "D:/ELK Stack/logstash-6.4.0/logstash-core/lib/logstash/agent.rb:309:in `block in converge_state'"]} [2018-09-17T17:27:24,252][DEBUG][logstash.agent] Starting puma [2018-09-17T17:27:24,276][DEBUG][logstash.agent] Trying to start WebServer {:port=>9600} [2018-09-17T17:27:24,362][DEBUG][logstash.api.service] [api-service] start [2018-09-17T17:27:24,728][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2018-09-17T17:27:26,626][WARN][logstash.runner] SIGINT received. Shutting down. ``` * * * Any help and guidance, redirect to simple explanatory documentation / external links much appreciated. Thanks in advance. Regards, Juneid. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 15, 2018, 12:02pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-config-file-help-required/148828/2 "2018-10-15T12:02:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.