Error loading yaml file-did not find expected key

Elastic Stack Beats
1

.\filebeat.exe modules enable apache
Error initializing beat: error loading config file: yaml line 70: did not find expected key

This is on line 70 on the filebeat file.

path: "C:\\Program Files\\filebeat\\module\\apache\\apache.yml"

The file and path all exist. I have triple/quadruple checked them. What gives?

2

Hi @vsekvsek, welcome to the Elastic Community forums!

YAML parsing can be finicky, sometimes due to whitespace issues. Could you use https://gist.github.com/ or https://pastebin.com/ to paste your entire Filebeat configuration file and separately also the entire C:\\Program Files\\filebeat\\module\\apache\\apache.ymlfile, and then post the two links here please?

Thanks,

Shaunak

3

hopefully this link works

4

Thanks,

I see that there are 3 spaces before path (on line 69 in pastebin). Everywhere else I see that fields at that level have 2 spaces before them. Can you try removing 1 space before path and see if that helps?

Shaunak

5

That fixed that issue thanks. I now get this error when trying to start it up.
PS C:\Program Files\filebeat> .\filebeat.exe setup Start-Service filebeat
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '<' looking for beginning of value]
PS C:\Program Files\filebeat>

here is a link to my current yml file. Can you see what I am missing?

6

Line 155:

  hosts: ["localhost:5601"]

This should almost certainly be:

  hosts: ["localhost:9200"]

The first Elasticsearch node in a cluster starts listening on port 9200 by default. Kibana starts listening on port 5601 by default but since this line pertains to the Elasticsearch output, you want to the port to be the one that Elasticsearch is listening on.

7

Thanks, made that change at line 155 and get past that but get this error next. I must be missing a json file or maybe its malformed? Also those log files its trying to rotate dont exist. Not sure if I need to turn on/off a setting somewhere?

PS C:\Program Files\filebeat> .\filebeat.exe setup Start-Service filebeat
2020-09-16 06:31:56.5647872 -0700 PDT m=+0.350059001 write error: failed to rotate backups: failed to rotate backups: rename C:\Program Files\filebeat\logs\filebeat.7 C:\Program Files\filebeat\logs\filebeat.8: Access is denied.
2020-09-16 06:31:57.6993527 -0700 PDT m=+1.484624501 write error: failed to rotate backups: failed to rotate backups: rename C:\Program Files\filebeat\logs\filebeat.7 C:\Program Files\filebeat\logs\filebeat.8: Access is denied.
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '<' looking for beginning of value]

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.