# Exiting: error loading config file: yaml: line 189: did not find expected key

**URL:** <https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 16, 2021, 11:49am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317 "2021-11-16T11:49:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![armughan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armughan/32/95804_2.png) [@armughan](https://discuss.elastic.co/u/armughan)\
**Post date:** [November 16, 2021, 11:49am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317/1 "2021-11-16T11:49:32Z")

</div>

Hi All,  
I'm trying to connect Filebeat with Elasticsearch After the configuration of filebeat.yml I'm having "Exiting: error loading config file: yaml: line 189: did not find expected key"

```auto
filebeat.inputs:

- type: log

  enabled: false

  paths:
    - /var/log/*.log

- type: filestream

  enabled: false
 
  paths:
    - /var/log/*.log

filebeat.config.modules:

  path: ${path.config}/modules.d/*.yml

  reload.enabled: false

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1

# =================================== Kibana ===================================

setup.kibana:
  host: "kibana.simplitech.ai"

# ================================== Outputs ===================================

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["elasticstack.example.ai:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "https"
  #protocol: "https"

output.elasticsearch.ssl.certificate_authorities: ["/etc/client/client-ca.crt"]
output.elasticsearch.ssl.certificate: "/etc/client/client.crt"
output.elasticsearch.ssl.key: "/etc/client/client.key"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  api_key: "cGh0VktIMEJNWThibUpGYi1UYjU6bWpNYzRGalVSSENxWGNsX1dCc3V6QQ=="
  #api_key: "phtVKH0BMY8bmJFb-Tb5:mjMc4FjURHCqXcl_WBsuzA"
# username: "elastic"
# password: "changeme"

# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

```

CURL request

`curl https://elasticstack.example.com:9200/_xpack/security/_authenticate?pretty --key client.key --cert client.crt --cacert client-ca.crt -k -v -H "Authorization: ApiKey cGh0VktIMEJNWThibUpGYi1UYjU6bWpNYzRGalVSSENxWGNsX1dCc3V6QQ=="`

CURL response

```auto
* Trying 54.211.123.112...
* TCP_NODELAY set
* Connected to elasticstack.example.com (54.211.123.112) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: client-ca.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Unknown (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Client hello (1):
* TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: CN=node-1
* start date: Oct 21 12:28:40 2021 GMT
* expire date: Oct 21 12:28:40 2026 GMT
* issuer: CN=Elastic Certificate Tool Autogenerated CA
* SSL certificate verify ok.
* TLSv1.3 (OUT), TLS Unknown, Unknown (23):
> GET /_xpack/security/_authenticate?pretty HTTP/1.1
> Host: elasticstack.example.com:9200
> User-Agent: curl/7.58.0
> Accept: */*
> Authorization: ApiKey cGh0VktIMEJNWThibUpGYi1UYjU6bWpNYzRGalVSSENxWGNsX1dCc3V6QQ==
>
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS Unknown, Unknown (23):
< HTTP/1.1 200 OK
< X-elastic-product: Elasticsearch
< Warning: 299 Elasticsearch-7.15.2-93d5a7f6192e8a1a12e154a2b81bf6fa7309da0c "[GET /_xpack/security/_authenticate] is deprecated! Use [GET /_security/_authenticate] instead."
< content-type: application/json; charset=UTF-8
< content-length: 358
<
{
  "username" : "elastic",
  "roles" : [],
  "full_name" : null,
  "email" : null,
  "metadata" : {
    "_reserved" : true
  },
  "enabled" : true,
  "authentication_realm" : {
    "name" : "_es_api_key",
    "type" : "_es_api_key"
  },
  "lookup_realm" : {
    "name" : "_es_api_key",
    "type" : "_es_api_key"
  },
  "authentication_type" : "api_key"
}
* Connection #0 to host elasticstack.example.com left intact

```

---

<div class="post-metadata">

**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\
**Post date:** [November 16, 2021, 12:47pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317/2 "2021-11-16T12:47:30Z")

</div>

Hi @armughan,

You need to change the line that starts with `api_key: "cGh..."` with this:

```auto
output.elasticsearch.api_key: "cGh..."

```

Make sure you remove the spaces in front. This should do the trick

---

<div class="post-metadata">

**Author:** ![armughan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armughan/32/95804_2.png) [@armughan](https://discuss.elastic.co/u/armughan)\
**Post date:** [November 17, 2021, 6:37am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317/3 "2021-11-17T06:37:30Z")

</div>

Still no luck same error.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2021, 6:38am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-189-did-not-find-expected-key/289317/4 "2021-12-15T06:38:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.