# Erreur filebeat/elasticsearch

**URL:** https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925
**Category:** Discussions en français
**Created:** [March 2, 2021, 9:01am UTC](https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925 "2021-03-02T09:01:08Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![steph-ipi-69](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steph-ipi-69/32/84796_2.png) [@steph-ipi-69](https://discuss.elastic.co/u/steph-ipi-69)
#### Post date: [March 2, 2021, 9:01am UTC](https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925/1 "2021-03-02T09:01:08Z")

</div>

Bonjour,  
je tente d'installer sur une redhat (Red Hat Enterprise Linux release 8.3 (Ootpa)) le triplé ealastisearch/filebeat/kibana depuis les infos github ([GitHub - molu8bits/squid-filebeat-kibana: Filebeat module for Squid access.log + Kibana dashboards. ELK 7.x](https://github.com/molu8bits/squid-filebeat-kibana)).  
Lorsque je souhaite démarrer filebeat je rencontre une erreur.  
filebeat[1061858]: Exiting: error loading config file: yaml: line 4: mapping values are not allowed in this context  
filebeat.service: Main process exited, code=exited, status=1/FAILURE  
filebeat.service: Failed with result 'exit-code'.  
filebeat.service: Service RestartSec=100ms expired, scheduling restart.  
filebeat.service: Scheduled restart job, restart counter is at 5.  
filebeat.service: Start request repeated too quickly.  
filebeat.service: Failed with result 'exit-code'.

voici le contenu du fichier de config

`  
filebeat.inputs:

- type: log  
enabled: false  
paths:
  - /var/log/\*.log

filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: true

setup.template.settings:  
index.number\_of\_shards: 3

setup.dashboards.enabled: true

setup.template.enabled: true  
setup.template.json.enabled: false

# Both two lines are required to add

setup.template.fields: "${path.config}/fields.yml"  
setup.template.overwrite: true

# string "eleasticsearch.local" must be replaced with Elasticsearch IP/Host

output.elasticsearch:  
hosts: ["ipdemaredhat:9200"]'  
`  
Merci

---

<div class="post-metadata">

### Author: ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)
#### Post date: [March 2, 2021, 3:59pm UTC](https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925/2 "2021-03-02T15:59:04Z")

</div>

Bonjour,

Sur le fichier de conf .yml, il faut (deja) que tu change la valeur en enabled à true.  
Et comme c'est un fichier YAML, faut bien respecter le syntaxes :

Peux-tu nous mettre la config en utilisant la balise \</\>

---

<div class="post-metadata">

### Author: ![steph-ipi-69](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steph-ipi-69/32/84796_2.png) [@steph-ipi-69](https://discuss.elastic.co/u/steph-ipi-69)
#### Post date: [March 4, 2021, 3:01pm UTC](https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925/5 "2021-03-04T15:01:17Z")

</div>

```
`filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log`

`filebeat.config.modules:`

```

`path: ${path.config}/modules.d/*.yml reload.enabled: true`

` setup.template.settings: index.number_of_shards: 3`

`setup.dashboards.enabled: true`

` setup.template.enabled: true setup.template.json.enabled: false`

` # Both two lines are required to add setup.template.fields: "${path.config}/fields.yml" setup.template.overwrite: true`

` # string "eleasticsearch.local" must be replaced with Elasticsearch IP/Host output.elasticsearch: hosts: ["monipserveur:9200"]`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2021, 3:12pm UTC](https://discuss.elastic.co/t/erreur-filebeat-elasticsearch/265925/7 "2021-04-01T15:12:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
