Loading config file error: YAML config parsing failed on /usr/local/etc/filebeat.yml

Elastic Stack Beats
1

FreeBSD 10.3, filebeat 1.2.3, when trying "service filbert start" I got endless error "Loading config file error: YAML config parsing failed on /usr/local/etc/filebeat.yml: yaml: line 7: found character that cannot start any token. Exiting."

What's wrong with this, [ls help. my filebeat.yml is as below:

################### Filebeat Configuration #########################

############################# Filebeat ######################################
filebeat:
  prospectors:
    -
      paths:
        - /var/log/messages
        - /var/log/security

      input_type: log
      document_type: syslog

############################# Output ##########################################

output:

  ### Logstash as output
  logstash:
    # The Logstash hosts
    hosts: ["192.168.11.24:5044"]
    bulk_max_size: 1024

    # Optional TLS. By default is off.
   tls:
      certificate_authorities: ["/usr/local/etc/logstash/logstash-forwarder.crt"]
2

YAML is sensitive to indentation so you must make sure the indentation is preserved when you post here. Otherwise it's impossible to tell what's wrong. Paste your configuration again and make sure it's formatted as code (use the toolbar button). A service like http://www.yamllint.com/ might also be helpful.

3

I did try to 'reformat' your post a little. But due to copy'n paste I can not if any special symbols/characters are missing. I see the tls option not being properly indented, but in original file there might be other errors.

4 
################### Filebeat Configuration #########################

############################# Filebeat ######################################
filebeat:
  prospectors:
    -
      paths:
        - /var/log/messages
        - /var/log/security

      input_type: log
      document_type: syslog
############################# Output ##########################################

output:

  ### Logstash as output
  logstash:
    hosts: ["192.168.11.24:5044"]
    bulk_max_size: 1024

   tls:
      certificate_authorities: ["/usr/local/etc/logstash/logstash-forwarder.crt"]
5

Sorry, but do you mean copy/paste and then use Performated Text? as i pasted above?

6

Sorry, but do you mean copy/paste and then use Performated Text? as i pasted above?

Yes. As @steffens noted the "tls:" line is incorrectly indented. Start by fixing that.

7

Thank you very much. My mistakes due to less knowledge of YAML. With the help of you I finally got it solved.

8

This topic was automatically closed after 21 days. New replies are no longer allowed.