Exiting: 1 error: error loading config file: invalid config: yaml: line 13: did not find expected key

Hi there,

I'm trying to connect Filebeat Snort module with my Elasticsearch and when i run command .\filebeat.exe setup -e on Windows 10 Pro VM, I got this error.

This is my configuration for filebeat.yml

- type: log
  enabled: true
    - 'C:\Snort\log\'

  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

  #index.number_of_shards: 1

  host: "MY KIBANA:5601"
  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Thank you.


From the error message it seems that something is wrong with the indentation in your config file.


1 Like

Thank you for replying, I run command .\filebeat.exe test config -e and it shows that the Config is okay. I also try to use yamllint.com to check and there is nothing wrong. I really stuck right now.

Had similiar problem before, to avoid config errors im always using below format examples in such cases

instead of ;

  hosts: ["MY ELASTIC:9200"]
  username: "USERNAME"
  password: "PASSWORD"

use this;

output.elasticsearch.hosts: ["MY ELASTIC:9200"]
output.elasticsearch.username: "USERNAME"
output.elasticsearch.password: "PASSWORD"

and edit all your config according to this format

1 Like

Thank you for your recommendation, tried this but the problem still remains. Wish this could solve it.