Configuration parse error

[saknopper]

When performing a config test on a fresh checkout of the master branch, I'm getting the following error:

./logstash -t -f modsec_conf/0000_header.conf 
Error: Expected one of #, input, filter, output at line 40, column 1 (byte 1515) after ##########################################################

I'm only parsing the header now since I was trying to determine the location of the error and it turns out to be the header...

Am I the only one with this issue?

Using logstash 1.5.5

[bitsofinfo]

@MWilkinson and @breml should chime in, there were recently some major refactoring changes that were merged in a PR #18 , sounds like one of those filter files is syntactically incorrect.

Until fixed, please use one of the versions under "releases"

[MWilkinson]

Hi @saknopper, can you please list which of the split files you have configured or which you have (if any) removed ?

Also the details of any custom filter files you may have added.

Regards

[bitsofinfo]

This is likely due to the file 0000_header.conf .. as line 39 is the last line and this file does not include ANY actual filter {} block....

[bitsofinfo]

@saknopper try removing 0000_header.conf

Also you should point to the conf/ dir only, rather than specifying only one of the files...

[breml]

The single configuration files of the modularized configuration are not intended to be used alone but to give the user the freedom to cherry-pick those parts he want's to use. In our case, the elements of the logstash-modsecurity configuration is only a part of our configuration.

It's in the users responsibility to build a valid logstash configuration.

[bitsofinfo]

We just need to include this kind of info in a README update

[saknopper]

When I remove 0000_header.conf the parse error goes away. I didn't modify anything else yet.

[saknopper]

I think I've found a potential cause of the issue. When I run

cat *.conf > modsecurity_mono.conf

And then look at monolithic file, I see this:

##########################################################
##########################################################input {

  stdin {
    type => "mod_security"

So somehow the first line of 1000_input_stdin_example.conf is appended to the last line of 0000_header.conf which is a comment line.

[saknopper]

It comes down to 0000_header.conf not having a newline at the end of the file. But there are several files with the same issue.