Filebeat not reading outputs from YAML

Elastic Stack Beats
1

I'm sure this will be a problem in my yaml but I can't see what it is.

I'm trying to run filebeat 1.3.0 on windows server 2012/

my config is in a file in the same directory as filebeat.exe called filebeat.yml

---
filebeat:
  prospectors:
    -
      paths:
        - "C:\\inetpub\\logs\\LogFiles\\*.log"
      input_type: iis
      document_type: iis
      exclude_lines: ["^#"]
      fields:
        application: application_name
        environment: production
      fields_under_root: true
  output:
    logstash:
      hosts: ["logstash.url:5044"]

when I run filebeat.exe -c filebeat.yml -e -v -d "*"

the output is

C:\filebeat-1.3.0-windows>filebeat.exe -c filebeat.yml -e -v -d "*"
2016/09/12 11:53:00.843627 beat.go:156: DBG  Initializing output plugins
2016/09/12 11:53:00.844301 geolite.go:24: INFO GeoIP disabled: No paths were set
 under output.geoip.paths
2016/09/12 11:53:00.846301 publish.go:269: INFO No outputs are defined. Please d
efine one under the output section.
Error Initialising publisher: No outputs are defined. Please define one under th
e output section.
2016/09/12 11:53:00.856499 beat.go:161: CRIT No outputs are defined. Please defi
ne one under the output section.

putting a console output instead of logstash doesn't have any effect.

I've edited the yml in notepad++ and confirmed that there are no tabs

2

You've indented the output block so that it's below filebeat in the structure, but it should be directly at the root of the YAML document, alongside filebeat.

1 Like
3

This topic was automatically closed after 21 days. New replies are no longer allowed.