Error creating input: each processor must have exactly one action,but found 2 actions (add_locale,decode_json_fields)

Elastic Stack Beats
1

hello
i have a cluster kubeadm and collecting logs with filebeat autodiscover
and i get this error after depoly

2023-07-12T09:34:19.588Z        INFO    log/input.go:152        Configured paths: [/var/log/pods/*_554a0c23-0fdb-4cbb-8f35-29449579bc11/pgpool/*.log]
2023-07-12T09:34:19.588Z        INFO    elasticsearch/client.go:171     Elasticsearch url: https://192.168.1.10:9200
2023-07-12T09:34:19.589Z        WARN    tlscommon/tls_config.go:79      SSL/TLS verifications disabled.
2023-07-12T09:34:19.595Z        INFO    elasticsearch/client.go:753     Attempting to connect to Elasticsearch version 7.6.0
2023-07-12T09:34:19.689Z        INFO    input/input.go:114      Starting input of type: container; ID: 15067651657585609803
2023-07-12T09:34:19.690Z        INFO    log/harvester.go:251    Harvester started for file: /var/log/pods/technical-rdbms-kubegres-d_pgpool-cf59d7d5d-t4skh_554a0c23-0fdb-4cbb-8f35-29449579bc11/pgpool/0.log
2023-07-12T09:34:19.788Z        ERROR   fileset/factory.go:105  Error creating input: each processor must have exactly one action, but found 2 actions (add_locale,decode_json_fields)
2023-07-12T09:34:19.788Z        ERROR   [autodiscover]  cfgfile/list.go:96      Error creating runner from config: each processor must have exactly one action, but found 2 actions (add_locale,decode_json_fields)

my configuration is this and is worked many long time

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-logging
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          host: ${HOSTNAME}
          hints.enabled: true
          hints.default_config:
             type: container
             paths:
               - /var/log/pods/*_${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log
             processors:
               - decode_json_fields:
                   fields: ["message"]
                   target: "json_message"
                   max_depth: 1
                   process_array: false
          templates:
            - condition:
                equals:
                  kubernetes.namespace: technical-rdbms-kubegres-d
              config:
                - module: postgresql
                  log:
                    input:
                      type: container
                      paths:
                        - /var/log/pods/*_${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log


    processors:
      - add_host_metadata:
      - add_kubernetes_metadata:
          in_cluster: true

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:"192.168.1.10"}:${ELASTICSEARCH_PORT:"9200"}']
      username: test
      password: xxxxx
      index: "2w-test-%{[kubernetes.namespace]}-%{+xxxx.ww}"
      protocol: "https"
      ssl.verification_mode: "none"
    setup.template:
      name: '2w-test'
      pattern: '2w-test-*'
      enabled: true

filebeat version is 7.5.0
Is there any idea to solve this problem?

2

Elasticsearch version 7.6.0 is EOL and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.