Exiting: 1 error: error loading config file: invalid config: yaml: line 13: did not find expected key

[awis (qir4ni)]

Hi there,

I'm trying to connect Filebeat Snort module with my Elasticsearch and when i run command .\filebeat.exe setup -e on Windows 10 Pro VM, I got this error.

This is my configuration for filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - 'C:\Snort\log\'

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#setup.template.settings:
  #index.number_of_shards: 1

setup.kibana:
  host: "MY KIBANA:5601"
 
output.elasticsearch:
  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Thank you.

[ChrsMark (Chris Mark)]

Hi!

From the error message it seems that something is wrong with the indentation in your config file.

C.

[awis (qir4ni)]

Thank you for replying, I run command .\filebeat.exe test config -e and it shows that the Config is okay. I also try to use yamllint.com to check and there is nothing wrong. I really stuck right now.

[FALEN (Ali Can Saykal)]

Had similiar problem before, to avoid config errors im always using below format examples in such cases

instead of ;

output.elasticsearch:
  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

use this;

output.elasticsearch.hosts: ["MY ELASTIC:9200"]
output.elasticsearch.username: "USERNAME"
output.elasticsearch.password: "PASSWORD"

and edit all your config according to this format

[awis (qir4ni)]

Thank you for your recommendation, tried this but the problem still remains. Wish this could solve it.