Filebeat config using keystore and arrays broke with Kibana 8 update

[archon810 (Artem Russakovskii)]

Hi there,

For years we've successfully used kibana filebeats where the var.paths variable was specified using the keystore rather than being hardcoded in the config file, like so:

vi /etc/filebeat/modules.d/custom_nginx.yml
#NGINX logs module
- module: custom_nginx
  access:
    enabled: true
    var.paths: "${NGINX_ACCESS_PATHS}"
  error:
    enabled: true
    var.paths: "${NGINX_ERROR_PATHS}"

The keystore value was specified like so:

filebeat keystore create
echo [\"/var/log/nginx/*-microcache.log\", \"/var/log/nginx/*-staticlb.log\"] | filebeat keystore add NGINX_ACCESS_PATHS --stdin --force
echo [\"/var/log/nginx/*error.log*\"] | filebeat keystore add NGINX_ERROR_PATHS --stdin --force

However, as of ES8, it seems that there's now a config parsing error:

Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error getting config for fileset custom_nginx/access: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over ["/var/log/nginx/*-microcache.log", "/var/log/nginx/*-staticlb.log"]

I'm not sure how to fix this. I tried moving the brackets (which is valid alternate syntax in YAML for arrays) into the config file and out of the keystore value, but without any luck. I also tried removing the quotes around the ${NGINX_XXXXXXX_PATHS} references to no avail.

Any ideas?

[cmacknz (Craig MacKenzie)]

If you are upgrading to the 8.3 release the problem may be this change: Upgrade elastic-agent-libs to pick up fix to keystore package by cmacknz · Pull Request #31694 · elastic/beats · GitHub

The configuration parser used for values loaded from the keystore used to parse commas and brackets as arrays, which lead to problems when valid passwords or secrets contained those characters. I don't think we anticipated this use of the keystore when we made that change, we were focused on the password/secret use case which is the main use case for the keystore.

The value parsing should still work the way you want with values kept outside of the keystore.