Exiting: 1 error: error loading config file: invalid config: yaml: line 13: did not find expected key

Hi there,

I'm trying to connect Filebeat Snort module with my Elasticsearch and when i run command .\filebeat.exe setup -e on Windows 10 Pro VM, I got this error.

This is my configuration for filebeat.yml

- type: log
  enabled: true
    - 'C:\Snort\log\'

  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

  #index.number_of_shards: 1

  host: "MY KIBANA:5601"
  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Thank you.


From the error message it seems that something is wrong with the indentation in your config file.


1 Like

Thank you for replying, I run command .\filebeat.exe test config -e and it shows that the Config is okay. I also try to use yamllint.com to check and there is nothing wrong. I really stuck right now.

Had similiar problem before, to avoid config errors im always using below format examples in such cases

instead of ;

  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

use this;

output.elasticsearch.hosts: ["MY ELASTIC:9200"]
output.elasticsearch.username: "USERNAME"
output.elasticsearch.password: "PASSWORD"

and edit all your config according to this format

1 Like

Thank you for your recommendation, tried this but the problem still remains. Wish this could solve it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.