Logstash configuration not compiling

Question

I use filebeat on multiple servers/applications that all feed to logstash, and I want to use a logstash configuration that parses one specific type of log and apply a grok pattern, while handling the rest as usual. This is what I have, but it's not working.

input {
  beats {
    port => 5044
    type => "log"
  }
}
filter {
  if [fields][type] == "transaction_router"{
    }
    grok {
      break_on_match => false
      match => { "message" => "%{DATE_US:date} %{TIME:timestamp},%{LOGLEVEL:loglevel} : %{DATA:component},%{DATA:log_level},\[%{DATA:chainCode}:%{DATA:storeCode}:%{DATA:terminalCode}:%{DATA:sequenceNumber}:%{DATA:userName}:%{DATA:clientTransactionID}]\[src=%{DATA:sourceUrl},fwd="%{DATA:forwardURL}",ses=%{DATA:session},ot=%{DATA:originalTransactionType},tt=%{DATA:currentTransactionType},amt=%{DATA:amount},rsp=%{DATA:hostResponse},card=%{DATA:card}] Response from host %{GREEDYDATA:responseFromHost}" }
    }
  }
output {
  stdout {
    codec => rubydebug
  }
  elasticsearch {
    hosts => ["redacted:9200"]
    index => "logstash-%{+YYYY.MM.dd}"
    user => "redacted"
    password => "redacted"
  }
}

I tested the pattern in the kibana grok debugger and it works there, so I'm not sure what's wrong but this configuration I get the following error:

[2023-01-12T16:42:42,965][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\", \"}\" at line 12, column 281 (byte 438) after filter {\n  if [fields][type] == \"transaction_router\"{\n    }\n    grok {\n      break_on_match => false\n      match => { \"message\" => \"%{DATE_US:date} %{TIME:timestamp},%{LOGLEVEL:loglevel} : %{DATA:component},%{DATA:log_level},\\[%{DATA:chainCode}:%{DATA:storeCode}:%{DATA:terminalCode}:%{DATA:sequenceNumber}:%{DATA:userName}:%{DATA:clientTransactionID}]\\[src=%{DATA:sourceUrl},fwd=\"", :backtrace=>["C:/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "C:/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "C:/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "C:/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}

Answer 1

There seems to have some issues with escaping the special characters like '"','[' and ',' Please try the below code

  grok {
  break_on_match => false
  match => { "message" => "%{DATE_US:date} %{TIME:timestamp}\,%{LOGLEVEL:loglevel} \: %{DATA:component}\,%{DATA:log_level}\,\[%{DATA:chainCode}\:%{DATA:storeCode}\:%{DATA:terminalCode}\:%{DATA:sequenceNumber}\:%{DATA:userName}\:%{DATA:clientTransactionID}\]\[src=%{DATA:sourceUrl}\,fwd=\"%{DATA:forwardURL}\"\,ses=%{DATA:session}\,ot=%{DATA:originalTransactionType}\,tt=%{DATA:currentTransactionType}\,amt=%{DATA:amount}\,rsp=%{DATA:hostResponse}\,card=%{DATA:card}\] Response from host %{GREEDYDATA:responseFromHost}" }
  }