title: Unable to ingest the syslog-logstash.conf for remove & replace functions
body: <p>I am just a newbie to the ELK and trying some testing on this, i'm able to run some tests but while i'm trying a filter with <code>grok</code> &amp; <code>mutate</code> to remoev &amp; replace some feilds from my syslog output i'm getting into below error..</p>
  
  <pre><code>21:58:47.976 [LogStash::Runner] ERROR logstash.agent - Cannot create pipeline {:reason=&gt;"Expected one of #, {, ,, ] at line 21, column 9 (byte 496) after filter {\n  if [type] == \"syslog\" {\n    grok {\n      match =&gt; { \"message\" =&gt; \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:hostname} %{DATA:program}(?:\\[%{POSINT:pid}\\])?: %{GREEDYDATA:syslog_message}\" }\n    }\n    date {\n      match =&gt; [ \"syslog_timestamp\", \"MMM  d HH:mm:ss\", \"MMM dd HH:mm:ss\" ]\n    }\n    mutate {\n      remove_field =&gt; [\n        \"message\",\n        \"pid\",\n        \"port\"\n        "}
  </code></pre>
  
  <blockquote>
    <p>Below is my config file ....</p>
  </blockquote>
  
  <pre><code># cat logstash-syslog2.conf
  input {
    file {
      path =&gt; [ "/scratch/rsyslog/*/messages.log" ]
      type =&gt; "syslog"
    }
  }
  
  filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:hostname} %{DATA:program}(?:\[%{POSINT:pid}\])?: %{GREEDYDATA:syslog_message}" }
      }
      date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
      mutate {
        remove_field =&gt; [
          "message",
          "pid",
          "port"
          "_grokparsefailure"
        ]
      }
      mutate {
        replace =&gt; [
          "@source_host", "%{allLogs_hostname}"
          "@message", "%{allLogs_message}"
        ]
      }
      mutate {
        remove =&gt; [
          "allLogs_hostname",
          "syslog_message",
          "syslog_timestamp"
        ]
      }
  }
  output {
    if [type] == "syslog" {
      elasticsearch {
        hosts =&gt; "localhost:9200"
        index =&gt; "%{type}-%{+YYYY.MM.dd}"
      }
    }
  }
  </code></pre>
  
  <p>please suggest what i'm doing wrong and  help to understand the remove &amp; replace functions for the lagstash..</p>
  
  <p>PS: my ELK version is 5.4</p>