Logstash Error: agent - Failed to execute action

Question

I've been following this tutorial on how to use ELK stack for nginx logs. I've created nginx.conf to configure how to get the logs but when i type: bin/logstash -f /etc/logstash/conf.d/nginx.conf

I get this error:

[ERROR] 2020-11-13 14:59:15.254 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [A-Za-z0-9_-], [ \t\r\n], "#", "=>" at line 9, column 8 (byte 135) after input{\n\t\n file{\n path => ["/var/log/nginx/access.log" , "/var/log/nginx/error.log"]\n
type => "nginx"\n }\n filter{\n \n grok", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:365:in block in converge_state'"]} and here's my nginx.conf file:

input{
    
   file{
   path => ["/var/log/nginx/access.log" , "/var/log/nginx/error.log"]
   type => "nginx"
   }
   filter{
   
   grok{
    match => ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
    overwrite => ["message"]
   }
   mutate{
    convert => ["response","integer"]
    convert => ["bytes","integer"]
    convert => ["responsetime","float"]
   }
   geoip{
    source => "clientip"
    target => "geoip"
    add_tag => ["nginx-geoip"]
   }
   date {
    match ⁼> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
    remove_field => ["timestamp"]
   }
   useragent {
   source => "agent"
   } 
   }

output{
 elasticsearch {
  hosts => ["localhost:9200"]
  index => "nginx-%{+yyyy.MM.dd}"
  document_type => "nginx_logs"
 }
}

}

I found similar question but the answer didn't help. Is there anyone familiar with logstash syntax and help figure out my error

Thank you

Answer 1

You are missing a } to close the input section. Insert it before the filter keyword.

Also, remove the last } in the file.