# Filebeat Config Failure

**URL:** <https://discuss.elastic.co/t/filebeat-config-failure/272061>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 4, 2021, 10:57am UTC](https://discuss.elastic.co/t/filebeat-config-failure/272061 "2021-05-04T10:57:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Himani\_Tawade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/himani_tawade/32/53699_2.png) [@Himani\_Tawade](https://discuss.elastic.co/u/Himani_Tawade)\
**Post date:** [May 4, 2021, 10:57am UTC](https://discuss.elastic.co/t/filebeat-config-failure/272061/1 "2021-05-04T10:57:53Z")

</div>

Hi All,

I am pretty new to the ELK stack.

I am trying to create multiple indices for different logs coming from the application.  
I am not using logstash and I am getting json logs from the app.  
But when I am trying to use the output.elasticsearch.indices option my setup is failing.  
Below is the error message:  
Exiting: error initializing publisher: wrong type,  
expect map accessing 'output.elasticsearch.indices.0.when.contains' (source:'/etc/filebeat/filebeat.yml')

I have tried multiple ways and this sounded promising but i am now stuck here.

Below is my filebeat.yml file i am using.

Also if the above idea will not work where do i configure in the filebeat.yml or is there anything i am missing here?

"""  
###################### Filebeat Configuration Example #########################

#------------------------------ Log input --------------------------------  
filebeat.inputs:

- type: log

#============================= Filebeat modules ===============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: true

# Period on which files under path should be checked for changes

reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:  
index.number\_of\_shards: 1

setup.dashboards.enabled: true

# ================================== Outputs ===================================

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

# Boolean flag to enable or disable the output module.

enabled: true

hosts: ["10.66.96.152:9200"]

# Protocol - either `http` (default) or `https`.

protocol: "https"

# Authentication credentials - either API key or username/password.

username: "admin"  
password: "elastic123"

#index: "xyz-%{[beat.version]}-%{[fields.flow\_type])-%{+yyyy.MM.dd}"  
indices:

- index: "dimensions-%{[agent.version]}-%{+yyyy.MM.dd}"  
when.contains:  
flow\_type:"dimensions"
- index: "facerd-%{[agent.version]}-%{+yyyy.MM.dd}"  
when.contains:  
flow\_type:"facerd"
- index: "reports-%{[agent.version]}-%{+yyyy.MM.dd}"  
when.contains:  
flow\_type:"reports"

ssl.enabled: true

ssl.verification\_mode: none

ssl.certificate\_authorities: ["/etc/filebeat/cacert.pem"]

# =================================== Kibana =================================

setup.kibana:

host: "10.66.96.152:5601"

protocol: "https"  
username: "admin"  
password: "elastic123"

ssl.enabled: true

ssl.verification\_mode: none

ssl.certificate\_authorities: ["/etc/filebeat/cacert.pem"]

setup.ilm.enabled: false  
setup.template.enabled: true  
setup.template.name: "%{[beat.version]}"  
setup.template.pattern: "%{[beat.version]}-\*"

"""

Would be really grateful if I get any pointers on this.  
Thanks,  
H

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2021, 9:58am UTC](https://discuss.elastic.co/t/filebeat-config-failure/272061/2 "2021-05-05T09:58:42Z")

</div>

Welcome to our community! 😃

Please format your code/logs/config using the `</>` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2021, 11:59am UTC](https://discuss.elastic.co/t/filebeat-config-failure/272061/3 "2021-06-02T11:59:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.