Filebeat config error: YAML config parsing failed

Below is my filebeat configuration file. I am trying to test my config file. The only changes I made were adding the paths to the log, commenting out elastic search output and outputting to logstash. The ... represents the commented out lines I deleted in order to format this post.

################### Filebeat Configuration Example #########################

############################# Filebeat ######################################
filebeat:
  # List of prospectors to fetch data.
  prospectors:
    ...
      paths:
        - /u01/app/oracle/admin/oam_domain/aserver/oam_domain/servers/AdminServer/logs/AdminServer.log
        - /u01/app/oracle/admin/oam_domain/aserver/oam_domain/servers/AdminServer/logs/AdminServer-diagnostic.log
        ...
  registry_file: /var/lib/filebeat/registry

###############################################################################
############################# Libbeat Config ##################################
# Base config file used by all other beats for using libbeat features

############################# Output ##########################################

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
output:

  ### Elasticsearch as output
  #elasticsearch:
    # Array of hosts to connect to.
    ...

    template:

      # Path to template file
      path: "filebeat.template.json"

      # Overwrite existing template
      #overwrite: false

    # Optional HTTP Path
    #path: "/elasticsearch"

  ### Logstash as output
  logstash:
    # The Logstash hosts
    # hosts: ["localhost:5044"]
    hosts: 
      - my.hostname:5044

    # Number of workers per Logstash host.
    #worker: 1

    # Set gzip compression level.
    #compression_level: 3

  #level: error

I get the following error:

Loading config file error: YAML config parsing failed on /usr/bin/filebeat.yml: yaml: line 278: did not find expected key. Exiting.

Line 278 is the logstash: line. I know this error is caused by indentation errors but I've parsed through my whole file and I don't see where the indentation is off.

Since you've obfuscated the file contents it's hard to help, but it looks suspicious that the "elasticsearch" line is commented but the "template" and "path" lines shortly thereafter aren't commented.

it is uncommented. for logstash output i don't need to define a template?

for logstash output i don't need to define a template?

You can't define a template for the Logstash output.

https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html#_logstash_output_options

got it. last question: when i start filebeat with /etc/init.d/filebeat start should I expect to see any output other than Starting filebeat:? Like with Kibana or Elasticsearch you have a "running" output but with filebeats when i started it this is all i saw.

should I expect to see any output other than Starting filebeat:?

In the terminal from which you ran the init script? Probably not. If Filebeat is running it's running.

Thanks!

This topic was automatically closed after 21 days. New replies are no longer allowed.