Filebeat config error: YAML config parsing failed

Elastic Stack Beats
1

Below is my filebeat configuration file. I am trying to test my config file. The only changes I made were adding the paths to the log, commenting out elastic search output and outputting to logstash. The ... represents the commented out lines I deleted in order to format this post.

################### Filebeat Configuration Example #########################

############################# Filebeat ######################################
filebeat:
  # List of prospectors to fetch data.
  prospectors:
    ...
      paths:
        - /u01/app/oracle/admin/oam_domain/aserver/oam_domain/servers/AdminServer/logs/AdminServer.log
        - /u01/app/oracle/admin/oam_domain/aserver/oam_domain/servers/AdminServer/logs/AdminServer-diagnostic.log
        ...
  registry_file: /var/lib/filebeat/registry

###############################################################################
############################# Libbeat Config ##################################
# Base config file used by all other beats for using libbeat features

############################# Output ##########################################

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
output:

  ### Elasticsearch as output
  #elasticsearch:
    # Array of hosts to connect to.
    ...

    template:

      # Path to template file
      path: "filebeat.template.json"

      # Overwrite existing template
      #overwrite: false

    # Optional HTTP Path
    #path: "/elasticsearch"

  ### Logstash as output
  logstash:
    # The Logstash hosts
    # hosts: ["localhost:5044"]
    hosts: 
      - my.hostname:5044

    # Number of workers per Logstash host.
    #worker: 1

    # Set gzip compression level.
    #compression_level: 3

  #level: error

I get the following error:

Loading config file error: YAML config parsing failed on /usr/bin/filebeat.yml: yaml: line 278: did not find expected key. Exiting.

Line 278 is the logstash: line. I know this error is caused by indentation errors but I've parsed through my whole file and I don't see where the indentation is off.

2

Since you've obfuscated the file contents it's hard to help, but it looks suspicious that the "elasticsearch" line is commented but the "template" and "path" lines shortly thereafter aren't commented.

3

it is uncommented. for logstash output i don't need to define a template?

4

for logstash output i don't need to define a template?

You can't define a template for the Logstash output.

5

got it. last question: when i start filebeat with /etc/init.d/filebeat start should I expect to see any output other than Starting filebeat:? Like with Kibana or Elasticsearch you have a "running" output but with filebeats when i started it this is all i saw.

6

should I expect to see any output other than Starting filebeat:?

In the terminal from which you ran the init script? Probably not. If Filebeat is running it's running.

7

Thanks!

8

This topic was automatically closed after 21 days. New replies are no longer allowed.