# Filebeat Not Using Provided Credentials File w/ GCP Module

**URL:** <https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 30, 2021, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801 "2021-04-30T15:14:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cappy](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@cappy](https://discuss.elastic.co/u/cappy)\
**Post date:** [April 30, 2021, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801/1 "2021-04-30T15:14:21Z")

</div>

`Version: 7.12.1`

I am getting the following when trying to enable the GCP module, using `audit`, `firewall`, and `vpcflow` filesets using `var.credentials_file: /etc/filebeat/filebeat/creds.json` :

```auto
Exiting: Failed to start crawler: starting input failed: Error while initializing input: no authentication credentials were configured or detected (credentials_file, credentials_json, and application default credentials (ADC)) accessing config

```

...even though I've checked the path (and permissions) for the credentials file, and it is correct. I've tried modifying path.config, etc as well, with no luck. If I explicitly set the `credentials_file` value in the `modules.d/gcp.yml`, it works, so it seems like it is not getting picked up somewhere.

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 30, 2021, 11:28pm UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801/2 "2021-04-30T23:28:54Z")

</div>

Hello @cappy .

I am a bit unsure what you mean, all module configuration needs to happen in `modules.d/modulename.yml`

So if you are inserting it into `gcp.yml` then that should be correct, are you trying to add it somewhere else?

---

<div class="post-metadata">

**Author:** ![cappy](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@cappy](https://discuss.elastic.co/u/cappy)\
**Post date:** [May 1, 2021, 2:35am UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801/3 "2021-05-01T02:35:32Z")

</div>

I see. Thank you for that. I must have misread, and was attempting to add the configuration to `filebeat.yml` under `filebeat.modules`, but it seems as though this is not the intended way to configure modules. It seems like this would be a centralized way to handle this, so I'm a bit surprised you need to configure them otherwise. Are there any plans to make this more centralized in the future?

For example, I added the following to filebeat.yml, and it seemed to work, but maybe it only worked because of coincidence?

```auto
- module: fortinet
  firewall:
    enabled: true
    var.input: udp
    var.syslog_host: 0.0.0.0
    var.syslog_port: 514
    input:
      fields_under_root: true

```

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [May 1, 2021, 6:39am UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801/4 "2021-05-01T06:39:19Z")

</div>

The reasons for it working is as you might see a bit later in filebeat.yml, we include all files under modules.d that ends with .yml so that they are combined in the end.

The reason this is split up, is because we have hundreds of integrations, so we would need to split them up somehow.

In terms of more automated and centralized, we do have our new Elastic Agent and Fleet in beta, which I think is what you are referring to. This will centralize all the beat management, config management etc in Kibana.  
For some more information on this:

> **[Overview | Fleet User Guide \[7.12\] | Elastic](https://www.elastic.co/guide/en/fleet/current/fleet-overview.html)**

> **[Easier data onboarding with Elastic Agent and Ingest Manager](https://www.elastic.co/blog/introducing-elastic-agent-and-ingest-manager)**
>
> Introducing Elastic Agent and Ingest Manager: Easier data onboarding with Elastic Agent and Ingest Manager

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2021, 8:39am UTC](https://discuss.elastic.co/t/filebeat-not-using-provided-credentials-file-w-gcp-module/271801/5 "2021-05-29T08:39:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.