Filebeat make update fails for new custom module

Elastic Stack Beats
1

I have followed the instructions:
https://www.elastic.co/guide/en/beats/devguide/7.8/filebeat-modules-devguide.html

create-module, create-fileset and create-fields all work correctly with no errors.
But the make update throws the following error:

mage update
Generated fields.yml for filebeat to /srv/test/beats/filebeat/fields.yml
Generated global fields.yml file for filebeat is invalid: yaml: line 6613: found a tab character where an indentation space is expected
exit status 3
Error: running "go run -mod=readonly /srv/test/beats/libbeat/scripts/cmd/global_fields/main.go -es_beats_path /srv/test/beats -beat_path /srv/test/beats/filebeat -out fields.yml module" failed with exit code 1
Makefile:13: recipe for target 'update' failed
make: *** [update] Error 1

The global fields.yml has only 5.334 lines. So I don´t understand the error message "...is invalid: yaml: line 6613...".

OS is: SLES 12 SP5

Can anyone help me?

2

Hey @cpohl, welcome to discuss :slightly_smiling_face:

Try checking the yaml syntax of the fields.yml files you have added, look specially for tab characters, try replacing them with spaces.

3

Thank you very much for the hint and I have found a tab character in my fields.yml.
Unfortunately I get now another fail by make update:

mage update
Generated fields.yml for filebeat to /srv/test/beats/filebeat/fields.yml
Generated fields.yml for filebeat to /srv/test/beats/filebeat/fields.yml
>> Building filebeat.yml for linux/amd64
>> Building filebeat.reference.yml for linux/amd64
>> Building filebeat.docker.yml for linux/amd64
exec: go list -m
Generated fields.yml for filebeat to /srv/test/beats/filebeat/build/fields/fields.all.yml
Traceback (most recent call last):
  File "/srv/test/beats/libbeat/scripts/generate_fields_docs.py", line 5, in <module>
    import yaml
ImportError: No module named 'yaml'
Error: running "/srv/test/beats/build/ve/linux/bin/python3 /srv/test/beats/libbeat/scripts/generate_fields_docs.py build/fields/fields.all.yml filebeat /srv/test/beats --output_path /srv/test/beats/filebeat" failed with exit code 1
Makefile:13: recipe for target 'update' failed
make: *** [update] Error 1

Is maybe my Python not correct installed?
Can anyone help me please?
Thanks a lot.

4

Yes, this looks like yaml is missing in the virtual environment used by mage. You can reinstall the dependencies with:

/srv/test/beats/build/ve/linux/bin/pip install -r /srv/test/beats/libbeat/tests/system/requirements.txt

Or if you remove the virtual environments directory (/srv/test/beats/build/ve/ in your case), mage will recreate it when needed.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.