Can't figure out source of config error in new filebeat module

Elastic Stack Beats
1

I've just walked through the documentation on creating a new filebeat module, tested my parser with the simulation API and then copied the files over to a docker container and fired it up. However, when it loads the module I'm getting a pretty unhelpful error:

|2018-07-23T07:30:53.697Z|INFO|log/input.go:113|Configured paths: [/opt/orderpages-server.log*]|
|---|---|---|---|
|2018-07-23T07:30:53.697Z|INFO|input/input.go:88|Starting input of type: log; ID: 16991430678465977839|
|2018-07-23T07:30:53.698Z|ERROR|cfgfile/reload.go:232|Error loading config: invalid config: yaml: invalid map key: map[interface {}]interface {}{"module":interface {}(nil)}|

Which config file is this referring to? That serverlog is the one my module is configured to pick up, so it seems intuitive that my module isn't quite right. I've checked all the .yml files in my module, I've copied over the modules.d/passion.yml.disabled, and I've run 'make update' and put the kibana/{5,6} files in the right place, etc. Would be nice if the error could give a hint as to the path it died on.

2

Could you share your configuration file? Also the directory tree of your module?
Also, does this happen when you run Filebeat without config reloading?

3

The filebeat config is this:

filebeat.config.modules:
enabled: true
path: /etc/filebeat/modules.d/*.yml
filebeat.modules:

  • module: nginx
    access:
    enabled: true
    error:
    enabled: true
  • module: system
    syslog:
    enabled: true
    auth:
    enabled: true
  • module: passion
    api:
    enabled: true
    filebeat.inputs:
  • type: log
    enabled: true
    paths:
    • /var/log/*.log
      setup.kibana:
      host: kibana
      protocol: "http"
      output.elasticsearch:
      hosts: ["elasticsearch"]
      protocol: "http"
      path: "/"

and the directory structure of my module is this:
./_meta
./_meta/config.yml
./_meta/docs.asciidoc
./_meta/fields.yml
./_meta/kibana
./_meta/kibana/6
./api
./api/_meta
./api/_meta/fields.yml
./api/config
./api/config/api.yml
./api/ingest
./api/ingest/pipeline.json
./api/manifest.yml
./api/test
./module.yml

This happens even with config reload off. Also wondering if "Enabled modules/filesets: nginx (access, error), system (auth, syslog), passion (api), ()" <-- that empty paren set at the end might be a bad thing?

4

Could you please format the config using </>?

5

Right, sorry.

   filebeat.config.modules:
      enabled: true
      path: /etc/filebeat/modules.d/*.yml
    filebeat.modules:
    - module: nginx
      access:
        enabled: true
      error:
        enabled: true
    - module: system
      syslog:
        enabled: true
      auth:
        enabled: true
    - module: passion
      api:
        enabled: true
    filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /var/log/*.log
    setup.kibana:
      host: kibana
      protocol: "http"
    output.elasticsearch:
      hosts: ["elasticsearch"]
      protocol: "http"
      path: "/"
1 Like
6

Any ideas?

7

Ok, it was my own fault. I had at some point copied a raw version of passion.yml.disabled with {{ module }} in it instead of passion.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.