Fileabeat Netflow

Elastic Stack Beats
1

Hi, I'm tryng to enable nfow module on production. My filebeat.yml:

filebeat.modules:

  • module: wazuh
    alerts:
    enabled: true
    archives:
    enabled: false

setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false

#output.elasticsearch.hosts: ['http://172.16.6.33:9200']
output.logstash.hosts: ["172.16.6.33:5000"]

Version: 7.4.2

Exiting: error loading config file: yaml: line 7: did not find expected key
Feb 19 16:55:16 wazuh systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Feb 19 16:55:16 wazuh systemd[1]: filebeat.service: Failed with result 'exit-code'.

2

Can you post your complete Filebeat configuration, enclosed in ``` so the formatting/indentation is preserved? Also, what version of Filebeat are you running? Finally, can you post the entire Filebeat log from the time it starts running to the time it stops with the failure?

3

Version: 7.4.2

Exiting: error loading config file: yaml: line 7: did not find expected key
Feb 19 16:55:16 wazuh systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Feb 19 16:55:16 wazuh systemd[1]: filebeat.service: Failed with result 'exit-code'.