Hi,
I was wondering if someone could shed some light on the issue im having. Currently have Elastic Search 6. Im currently trying to send .json files to the Elastic search via logstash. the issue im having on the filebeat.yml i have configured this
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/jsonlogs/*.json
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
but when i restart filebeat i keep getting
filebeat[12237]: Exiting: error loading config file: yaml: line 29: mapping values are not allowed in this context
It is difficult to tell what line 29 is, but it looks like you may have incorrect indentation, which could cause problems as yaml is indentation sensitive.
YAML (file format used by filebeat) is sensitive to indentation. You can use yamllint.com to check your complete file. Just having a snippet from your config + a line number in you full config file makes it really hard to tell where you have the syntax error. Btw. json.add_error_key: true seems to be missing a space . Also allign comments with settings. All indentation looks a little off and there might be other issues in your file => yamllint.com
@Christian_Dahlqvist and @steffens Thanks for the replies, your both correct. If anyone else has the same issue its because the : true has to be together and no spaces.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.