# I get this error when i restart my filebeat in ELK
**URL:** https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109
**Category:** Beats
**Tags:** filebeat
**Created:** [March 27, 2017, 9:27am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109 "2017-03-27T09:27:06Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [March 27, 2017, 9:27am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/1 "2017-03-27T09:27:07Z")
sudo service filebeat restart
- Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 223: found character that cannot start any token. Exiting.
[fail]
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [March 27, 2017, 10:00am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/2 "2017-03-27T10:00:57Z")
> [@Jonesthomas](#):
>
> file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml
It looks like something is wrong in your `filebeat.yml`, can you share that line (223) and its full context?
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [March 27, 2017, 10:03am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/3 "2017-03-27T10:03:01Z")
```
### Logstash as output
logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
bulk_max_size: 1024
# Number of workers per Logstash host.
#worker: 1
# Optional load balance the events between the Logstash hosts
#loadbalance: true
# Optional index name. The default index name depends on the each beat.
# For Packetbeat, the default is set to packetbeat, for Topbeat
# top topbeat and for Filebeat to filebeat.
#index: filebeat
# Optional TLS. By default is off.
tls:
# List of root certificates for HTTPS server verifications
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
# Certificate for TLS client authentication
#certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#certificate_key: "/etc/pki/client/cert.key"
# Controls whether the client verifies server certificates and host name.
# If insecure is set to true, all server host names and certificates will be
# accepted. In this mode TLS based connections are susceptible to
# man-in-the-middle attacks. Use only for testing.
#insecure: true
# Configure cipher suites to be used for TLS connections
#cipher_suites: []
# Configure curve types for ECDHE based cipher suites
#curve_types: []
```
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [March 28, 2017, 8:11am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/4 "2017-03-28T08:11:25Z")
Skimming the sample, I don't see anything wrong with the sample snippet. Did you mix tabs and spaces by accident?
have you tried to lint your config (e.g. with [yamllint.com](http://yamllint.com)) ? Not having the full configuration file it's quite hard to jump to line `223` to fix the error... (please properly format your config)
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [March 28, 2017, 11:03am UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/5 "2017-03-28T11:03:34Z")
this is the content in the 223 line
220: ### Logstash as output
221: logstash:
222: #the Logstash hosts
223: hosts: ["localhost:5044"]
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [March 28, 2017, 12:22pm UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/6 "2017-03-28T12:22:05Z")
your line numbering is off by one 😉
I reformatted your post. It's `bulk_max_size` setting being clearly off.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2017, 12:22pm UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109/7 "2017-04-25T12:22:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.