Error initializing processors

Elastic Stack Beats
1

Hello.
I'm trying to make filebeat send logs excluding some messages.

Config:

filebeat.prospectors:
    - input_type: log
      document_type: exchange
      paths:
       - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG
      ignore_older: 336h

processors:
  - drop_event:
    when:
      regexp:
        message: 'MicrosoftExchange.+@kirmarket\.ru'

output:
  logstash:
    hosts: ["logs:5044"]

On start i get error:

Exiting: error initializing processors: each processor needs to have exactly one action, but found 2 actions

What is wrong? Where is the 2nd action?

2

Yaml files are sensitive to indentation, and based on the formatting it seems all configuration lines may not be properly aligned.

3

Yeah.
Looks like indentation in yaml is kinda tricky.
This works:

processors:
   - drop_event:
      when:
         regexp:
            message: 'MicrosoftExchange.+@kirmarket\.ru'

Each line is indented by 3 spaces x (number of line - 1).

Also found better solution for initial problem:

filebeat.prospectors:
  - input_type: log
    document_type: exchange
    paths:
      - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG
    ignore_older: 336h
    exclude_lines: ['MicrosoftExchange.+@kirmarket\.ru','HealthMailbox.+@kirmarket\.ru']    <==== this
4

exclude_lines is definitely better suited. Anyways, one can reduce indentation somewhat (we indent by 2 spaces):

processors:
- drop_event:
    when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru'
5

Thank you.

PS:
I used your example. Results:
2 spaced indentation: same error.
3+ spaced indentation: all works correctly.

Is this a bug or intended behavior?

6

Hm.... I'm always using 2 spaces and never have had any problems. You sure you don't have any tabs in your file by accident?

7

Yes, sure. Only 2 spaces in front of "when". Not working.

processors:
- drop_event:
  when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru'

In other parts of config file 2-spaced indentations works fine.

filebeat.prospectors:
  - input_type: log
    document_type: exchange
    paths:
      - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK2*.LOG
    ignore_older: 336h
    exclude_lines: ['MicrosoftExchange.+@kirmarket\.ru','HealthMailbox.+@kirmarket\.ru','postmaster@kirmarket\.ru']
    close_inactive: 2h

processors:
- drop_event:
  when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru'

output:
  logstash:
    hosts: ["logs:5044"]

Also, filebeat version is filebeat-5.5.0-windows-x86_64

8

Oh, I see. Well, the when-clause must be indented within the drop_event namespace. Check my sample, I did use 4 spaces on the when-clause.

9

OK, I get it... I guess.
Thank you for help.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.