Filebeats : failed to start found a tab character

Elastic Stack Beats
1

Hi !

When I try to launch filebeat I have this error message :

< Feb 12 11:49:40 localhost.localdomain systemd[1]: Unit filebeat.service entered failed state.
Feb 12 11:49:40 localhost.localdomain systemd[1]: filebeat.service failed.
Feb 12 11:49:40 localhost.localdomain systemd[1]: filebeat.service holdoff time over, scheduling restart.
Feb 12 11:49:40 localhost.localdomain systemd[1]: Started filebeat.
Feb 12 11:49:40 localhost.localdomain systemd[1]: Starting filebeat...
Feb 12 11:49:40 localhost.localdomain filebeat[52004]: Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 15: found a tab character that violate indentation. Exiting.
Feb 12 11:49:40 localhost.localdomain systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE />

It's arrived when I add TLs certificate :

filebeat:
  # List of prospectors to fetch data.
  prospectors:
    # Each - is a prospector. Below are the prospector specific configurations
    -
      # Paths that should be crawled and fetched. Glob based paths.
      # To fetch all ".log" files from a specific level of subdirectories
      # /var/log/*/*.log can be used.
      # For each file found under this path, a harvester is started.
      # Make sure not file is defined twice as this can lead to unexpected behaviour.
      paths:
        - /var/log/*.log
        - /var/log/secure
        - /var/log/messages
        #- c:\programdata\elasticsearch\logs\*
      # Type to be published in the 'type' field. For Elasticsearch output,
      # the type defines the document type these entries should be stored
      # in. Default: log
      document_type: syslog
# Optional index name. The default index name depends on the each beat.
    # For Packetbeat, the default is set to packetbeat, for Topbeat
    # top topbeat and for Filebeat to filebeat.
    #index: filebeat

    # Optional TLS. By default is off.
    tls:
      certificate_authorities: ["/etc/ssl/logstash_frwrd.crt"]

      # Certificate for TLS client authentication
      #certificate: "/etc/pki/client/cert.pem"
2

The error means that you inserted a \t character in YAML. You should just replace that with spaces. Just google how to do that in your editor or use expand, then double check that the indentation looks right.

3

This topic was automatically closed after 21 days. New replies are no longer allowed.