Filebeat failing to start due to YAML error, but which config file is it complaining about?

Elastic Stack Elasticsearch
1

I'm attempting to use Filebeat to ingest logs from Zeek, but I'm getting the following error when I start Filebeat:

Here's my /etc/filebeat/filebeat.yml file:

Yamllint tells me that there's an issue with this: "Map keys must be unique at line 234, column 1" (that line is 'output.elasticsearch:'). I don't understand!

And here's my /etc/filebeat/modules.d/zeek.yml file:

Yamllint tells me this one is formatted correctly.

The error message doesn't tell me which file is problematic.

Any assistance would be greatly appreciated!

Also, what am I doing wrong with my Gist links? Other people have sleek little windows with just the text content. I've got these chunky things with lots of Github stuff in the frame.

2

What is the error message? You didn't share it.

Looking at your filebeat.yml file it has a duplicated key, you have output.elasticsearch and hosts twice in the configuration, you can have it only once.

Check lines 139-141 and lines 234-240.

3

Whoops, my mistake. The error is here:

4

Ok, I commented out the duplicate key, and restarted the elasticsearch and filebeat services. I get the same error from filebeat.

5

This is the entire log you have? Do you have other lines? This is not helpful indeed.

Please share the entire log you are receiving from filebeat.

6

Yes, here's the whole error:

7

The error is in the zeek.yml file.

{"log.level":"error","@timestamp":"2023-08-17T19:47:42.203Z","log.origin":{"file.name":"cfgfile/reload.go","file.line":270},"message":"Error loading config from file '/etc/filebeat/modules.d/zeek.yml', error invalid config: yaml: line 5: mapping values are not allowed in this context","service.name":"filebeat","ecs.version":"1.6.0"}

Looking at the file you shared:

- module: zeek
    capture_loss:
        enabled: true
        var.paths: ["/mnt/Bro/current/capture_loss.log"]
    connection:
        enabled: true
        var.paths: ["/mnt/Bro/current/conn.log"]

The indentation is different from the one that is expected.

capture_loss, connection etc should be on the same column of - module.


- module: zeek
  capture_loss:
    enabled: true
    var.paths: ["/mnt/Bro/current/capture_loss.log"]
  connection:
    enabled: true
    var.paths: ["/mnt/Bro/current/conn.log"]

Not sure if this is the issue, but since yml files are pretty sensible to indentation, it may be.

8

Yes! This was the issue! Thank you so much for your help.

I had copied and pasted the config file to notepad++, which messed with the indentation.

Thanks again.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.