Logstash HTTP input plugin configuration error: Expected one of #

Question

I am attempting to configure the logstash HTTP input plugin following the official documentation. I have the following config saved in the 10-syslog.conf

input {
   port => 8080
   user => elkadmin
   password => "xxxx"
   ssl => off
}
output {
  elasticsearch {
    host => "127.0.0.1"
   codec => "json"
    index => "logstash-%{+YYYY.MM.dd}"
    protocol => "http"
  }
  stdout { codec => rubydebug }
}

Logstash does start successfully when using the following command:

sudo service logstash restart

I have ran the configuration check on the configuration file for the input plugin using the

/opt/logstash/bin/logstash -configtest -f 10-syslog.conf

The config check came back with the following error:

Error: Expected one of #, { at line 2, column 9 (byte 18) after input {

Looking at the logstash log I can see that it may be caused by permissions:

{:timestamp=>"2016-10-16T20:41:30.900000+0000", :message=>"The error reported is: \n Permission denied - /etc/logstash/conf.d/10-syslog.conf"}

I am very much unsure how to proceed here and any help and/or guidance would be more than appreciated.

Val Val · Accepted Answer · 2016-10-17T05:02:50

You're simply missing the name of the http input plugin in your input section (the typo comes from the blog article you linked to)

input {
  http {                   <--- add this
    port => 8080
    user => elkadmin
    password => "xxxx"
    ssl => off
  }
}

Also note that in your elasticsearch output plugin, host should read hostsand protocol is not supported anymore.

Your link is old (from 2015), you should preferably use the latest documentation at https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http.html

Logstash HTTP input plugin configuration error: Expected one of #

1 Answers