ConfigurationError in Logstash

Question

When I run this configuration file:

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
  codec => multiline {
    pattern => "\""
    negate => true
    what => previous
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
  skip_empty_columns => true
  skip_empty_row => true
}

# quote_char => "'"

output {
  stdout { codec => rubydebug }
}

I get this error:

Error: [2021-09-22T15:57:04,929][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "{" at line 7, column 9 (byte 226) after input {\n file {\n\t\tpath => "/tmp/linuxServerHealthReport.csv"\n start_position => "beginning"\n sincedb_path => "/home/imiinfra/logstash-7.14.1/snowdb/health_check"\n }\n\t\tcodec ", :backtrace=>["/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/agent.rb:391:in block in converge_state'"]}

Answer 1

You have to work on your formatting, but this is what I have reconstructed from the question. Main issues seem to be parameters of file, you put codec outside of file for some reason. The other issue is csv parameters skip_empty_columns and skip_empty_row which were also outside of csv.

So I did a little bit of formatting and fixed those issues and it should work now.

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    codec => multiline {
      pattern => "\""
      negate => true
      what => previous
    }
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
    skip_empty_columns => true
    skip_empty_row => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
}

output {
  stdout { codec => rubydebug }
}