Filebeat: Exiting: Failed to start crawler: creating module reloader failed: string value is not set accessing 'connection_string'

Hello

Im suddenly getting this error in Filebeat.

Im not sure really where to look at I wasnt getting this error before.

Any ideas?

Thank you

I have upgraded my elastic cloud deployment and the filebeat agent to 7.13.2 today and encounter the same issue now as @riahc3 - help would be greatly appreciated, everything was working fine before the update.

2021-06-22T13:08:43.862Z        INFO    [azure-eventhub input]  azureeventhub/input.go:94       Initialized azure-eventhub input.       {"connection string": "Endpoint=sb://fn-aurora-nonprod-frankfurt.servicebus.windows.net/"}
2021-06-22T13:08:43.862Z        ERROR   [reload]        cfgfile/list.go:99      Error creating runner from config: failed to create input: reading azure-eventhub input config: string value is not set accessing 'connection_string'

This is the actual debug log output that reoccurs every ~10 seconds. If necessary, I can also provide the full azure.yml file.

Im on 7.10.x

I'm getting the same error on 7.13.2. When I revert to 7.10.0 I don't get the error.

Just like the parent comment, my logs show that filebeat is reading a non-empty value for connection_string, and then the logs show an error which seems so indicate the value is empty.

@joecullin.skout
Could you try editing your azure.yml so unused logs are explicitly disabled for each instance of the azure module?
F.e. like in my example here:

- module: azure
  activitylogs:
    enabled: true
    var:
      eventhub: "fn-aurora-dev-west-operational-logs"
      consumer_group: "$Default"
      connection_string: "Endpoint=xxx"
      storage_account: "xxx"
      storage_account_key: "xxx"
      resource_manager_endpoint: ""
  auditlogs:
    enabled: true
    var:
       eventhub: "fn-aurora-dev-west-auditlogs"
       consumer_group: "$Default"
       connection_string: "Endpoint=xxx"
       storage_account: "xxx"
       storage_account_key: "xxx"
       resource_manager_endpoint: ""
  platformlogs:
    enabled: false
  signinlogs:
    enabled: false

Adding the last four lines fixed the issue for me.

Thanks @Degru , that worked for me!

We're using signinlogs, auditlogs, and activitylogs, so I added the following to explicitly disable platformlogs.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.