# Error initializing processors **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 4, 2017, 6:37am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247 "2017-09-04T06:37:43Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![BeerRider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beerrider/32/20062_2.png) [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Post date:** [September 4, 2017, 6:37am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/1 "2017-09-04T06:37:43Z")
Hello. I'm trying to make filebeat send logs excluding some messages. Config: ``` filebeat.prospectors: - input_type: log document_type: exchange paths: - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG ignore_older: 336h processors: - drop_event: when: regexp: message: 'MicrosoftExchange.+@kirmarket\.ru' output: logstash: hosts: ["logs:5044"] ``` On start i get error: > Exiting: error initializing processors: each processor needs to have exactly one action, but found 2 actions What is wrong? Where is the 2nd action? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 4, 2017, 8:51am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/2 "2017-09-04T08:51:30Z")
Yaml files are sensitive to indentation, and based on the formatting it seems all configuration lines may not be properly aligned. ---
**Author:** ![BeerRider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beerrider/32/20062_2.png) [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Post date:** [September 4, 2017, 10:51am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/3 "2017-09-04T10:51:11Z")
Yeah. Looks like indentation in yaml is kinda tricky. This works: ``` processors: - drop_event: when: regexp: message: 'MicrosoftExchange.+@kirmarket\.ru' ``` Each line is indented by 3 spaces x (number of line - 1). Also found better solution for initial problem: ``` filebeat.prospectors: - input_type: log document_type: exchange paths: - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK*.LOG ignore_older: 336h exclude_lines: ['MicrosoftExchange.+@kirmarket\.ru','HealthMailbox.+@kirmarket\.ru'] <==== this ``` ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 4, 2017, 1:37pm UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/4 "2017-09-04T13:37:54Z")
`exclude_lines` is definitely better suited. Anyways, one can reduce indentation somewhat (we indent by 2 spaces): ```auto processors: - drop_event: when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru' ``` ---
**Author:** ![BeerRider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beerrider/32/20062_2.png) [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Post date:** [September 6, 2017, 4:23am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/5 "2017-09-06T04:23:48Z")
Thank you. PS: I used your example. Results: 2 spaced indentation: same error. 3+ spaced indentation: all works correctly. Is this a bug or intended behavior? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 6, 2017, 11:39am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/6 "2017-09-06T11:39:34Z")
Hm.... I'm always using 2 spaces and never have had any problems. You sure you don't have any tabs in your file by accident? ---
**Author:** ![BeerRider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beerrider/32/20062_2.png) [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Post date:** [September 7, 2017, 5:03am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/7 "2017-09-07T05:03:20Z")
> [@steffens](#): > > You sure you don’t have any tabs in your file by accident? Yes, sure. Only 2 spaces in front of "when". Not working. ``` processors: - drop_event: when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru' ``` In other parts of config file 2-spaced indentations works fine. ``` filebeat.prospectors: - input_type: log document_type: exchange paths: - d:\Program Files\Exchange Server 2013\TransportRoles\Logs\MessageTracking\MSGTRK2*.LOG ignore_older: 336h exclude_lines: ['MicrosoftExchange.+@kirmarket\.ru','HealthMailbox.+@kirmarket\.ru','postmaster@kirmarket\.ru'] close_inactive: 2h processors: - drop_event: when.regexp.message: 'MicrosoftExchange.+@kirmarket\.ru' output: logstash: hosts: ["logs:5044"] ``` Also, filebeat version is filebeat-5.5.0-windows-x86\_64 ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 7, 2017, 11:06am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/8 "2017-09-07T11:06:41Z")
Oh, I see. Well, the when-clause must be indented within the `drop_event` namespace. Check my sample, I did use 4 spaces on the when-clause. ---
**Author:** ![BeerRider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beerrider/32/20062_2.png) [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Post date:** [September 8, 2017, 9:18am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/9 "2017-09-08T09:18:30Z")
OK, I get it... I guess. Thank you for help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 6, 2017, 9:18am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247/10 "2017-10-06T09:18:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.