Filebeat reports config is invalid but it all passes YAML Linting (with solution)

I've just spent the last 30 minutes figuring this out and finally found the problem and figure it may help someone else so posting here.

Starting filebeat, it starts ok but then exits right away. In the log the last line is

Exiting: 2 errors: invalid config: yaml: line 5: did not find expected '-' indicator; invalid config: yaml: line 5: did not find expected '-' indicator

Clearly a YAML error in the config file right? Well I triple checked it, ran it though a YAML linter, ran filebeat test config -c filebeat.yml and it all passed. So what gives?

Turns out there was a YAML error...but it was in the yaml for one of the modules! Scrolling back up in the log file, the error was more clearly IDed and looking in the module file, it was an obvious YAML indentation problem.

So, lesson learned - check ALL of the config files! It's too bad that filebeat test config -c filebeat.yml doesn't suck in the configured modules as well and test them or I suspect it would have caught this.

Hope this helps someone else!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.