Using Filebeat 5.6.14 we've noticed that it ignores prospector configuration files that are kept in a separate directory if they have the official ".yaml" name extension instead of ".yml". The shorter one is commonly used, but should both be accepted since the longer one is preferred? (See https://yaml.org/faq.html). It took us a while to figure out why this wasn't working since Filebeat doesn't give an error and just acts like the files don't exist.
Has this been fixed in a more recent version of beats?
Hi @PMDubuc, thanks for posting here. What's the file name for the prospector config? I think prospector is replaced by the concept of input. I did try on the latest Filebeat with filebeat.yaml instead of filebeat.yml. It showed error:
Exiting: error loading config file: stat filebeat.yml: no such file or directory.
Thank you. for your response. I think you get that error message because the -c argument to filebeat still specifies filebeat.yml instead of filebeat.yaml so changing only the filename and not the argument to filebeat causes the error. My problem was different. It's possible to specify prospector or input definitions in separate configuration files instead of the filebeat.yml file. In this case you use the config_dir setting in filebeat.yml to specify the directory where these input definition files are located (see https://www.elastic.co/guide/en/beats/filebeat/current/configuration-general-options.html#_config_dir). The problem is that these files must end in ".yml" instead of ".yaml" or they will be ignored with with an error saying that there are no inputs defined. Since ".yaml" is the preferred suffix for files containing YAML, I think it should also be valid.
I just noticed that this problem can apparently be solved in versions after 6.0 by using the filebeat.config.inputs section of the filebeat.yml file where it looks like you can specify a glob pattern for the files (https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html#load-input-config). If that works then we can avoid the problem when we upgrade to the latest version.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.