Metricbeat unable to start

[mmmguy]

Anyone ever have issues getting the metricbeat service to start on a 2012 R2 server where the filebeat log says Exiting: can not convert 'object' into 'string' accessing '0.hosts.0' (source:'C:\ProgramData\Elastic\Beats\metricbeat\modules.d\auto-auth.yml')

[mtojek (Marcin Tojek)]

Hi,

would you mind sharing this file (auto-auth.yml)? Have you modified it?

[VamPikmin]

I know this is Windows, but can you try forward slashes instead?

C:/ProgramData/…

[mmmguy]

It has been customized. It happens on any of the module.d files in there. I can disable the first one and it will fail at the next one in line.

Here is the contents of the auto-actions.yml file it fails on first.

# Module: sql
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.8/metricbeat-module-sql.html
# PS

- module: sql
  metricsets:
    - query
  period: 1m
  hosts: ["Removed Specific Information"]

  driver: "mysql"
  sql_query: 'Query Removed'
  sql_response_format: table

---

One thing I noticed with this one machine facing the issue, when opening this file in Notepad there is no format to the file, even with Word Wrap on. If I open this file on my personal machine I see the formatting correctly.

I can take the file from this non-working machine and put it in a different machine and it works fine. Take a working machine's file and put it in the non-working machine and it fails to start the service. I have also attempted to uninstall/reinstall the Metricbeat agent.

[mmmguy]

If it helps, here is the log file.

2022-01-05T10:39:49.903-0600 INFO instance/beat.go:647 Home path: [C:\Program Files\Elastic\Beats\7.8.0\metricbeat] Config path: [C:\ProgramData\Elastic\Beats\metricbeat] Data path: [C:\ProgramData\Elastic\Beats\metricbeat\data] Logs path: [C:\ProgramData\Elastic\Beats\metricbeat\logs]
2022-01-05T10:39:49.905-0600 INFO instance/beat.go:655 Beat ID: REMOVED INFORMATION
2022-01-05T10:39:49.912-0600 INFO [beat] instance/beat.go:983 Beat info {"system_info": {"beat": {"path": {"config": "C:\ProgramData\Elastic\Beats\metricbeat", "data": "C:\ProgramData\Elastic\Beats\metricbeat\data", "home": "C:\Program Files\Elastic\Beats\7.8.0\metricbeat", "logs": "C:\ProgramData\Elastic\Beats\metricbeat\logs"}, "type": "metricbeat", "uuid": "REMOVED INFORMATION"}}}
2022-01-05T10:39:49.912-0600 INFO [beat] instance/beat.go:992 Build info {"system_info": {"build": {"commit": "f79387d32717d79f689d94fda1ec80b2cf285d30", "libbeat": "7.8.0", "time": "2020-06-14T18:20:02.000Z", "version": "7.8.0"}}}
2022-01-05T10:39:49.912-0600 INFO [beat] instance/beat.go:995 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":6,"version":"go1.13.10"}}}
2022-01-05T10:39:49.916-0600 INFO [beat] instance/beat.go:999 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2022-01-04T04:01:51.25-06:00","name":"REMOVED INFORMATION","ip":["REMOVED INFORMATION"],"kernel_version":"6.3.9600.20201 (winblue_ltsb_escrow.211115-1606)","mac":["REMOVED INFORMATION"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2012 R2 Datacenter","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.20207"},"timezone":"CST","timezone_offset_sec":-21600,"id":"REMOVED INFORMATION"}}}
2022-01-05T10:39:49.916-0600 INFO [beat] instance/beat.go:1028 Process info {"system_info": {"process": {"cwd": "C:\Windows\system32", "exe": "C:\Program Files\Elastic\Beats\7.8.0\metricbeat\metricbeat.exe", "name": "metricbeat.exe", "pid": 7612, "ppid": 580, "start_time": "2022-01-05T10:39:48.964-0600"}}}
2022-01-05T10:39:49.916-0600 INFO instance/beat.go:310 Setup Beat: metricbeat; Version: 7.8.0
2022-01-05T10:39:49.916-0600 INFO [index-management] idxmgmt/std.go:183 Set output.Elasticsearch.index to 'metricbeat-7.8.0' as ILM is enabled.
2022-01-05T10:39:49.917-0600 INFO eslegclient/connection.go:97 Elasticsearch url: https://REMOVEDINFORMATION:443/elastic
2022-01-05T10:39:49.917-0600 INFO [publisher] pipeline/module.go:113 Beat name: REMOVED_INFORMATION
2022-01-05T10:39:49.936-0600 INFO instance/beat.go:463 metricbeat start running.
2022-01-05T10:39:49.936-0600 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2022-01-05T10:39:49.940-0600 INFO [monitoring] log/log.go:153 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":93,"time":{"ms":93}},"total":{"ticks":171,"time":{"ms":171},"value":171},"user":{"ticks":78,"time":{"ms":78}}},"handles":{"open":206},"info":{"ephemeral_id":"69e5e431-bd96-4cc8-a52b-1c534ba1b5d4","uptime":{"ms":920}},"memstats":{"gc_next":14067296,"memory_alloc":11761304,"memory_total":24586456,"rss":45686784},"runtime":{"goroutines":41}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"Elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"system":{"cpu":{"cores":6}}}}}
2022-01-05T10:39:49.940-0600 INFO [monitoring] log/log.go:154 Uptime: 920.9846ms
2022-01-05T10:39:49.940-0600 INFO [monitoring] log/log.go:131 Stopping metrics logging.
2022-01-05T10:39:49.940-0600 INFO instance/beat.go:469 metricbeat stopped.
2022-01-05T10:39:49.942-0600 ERROR instance/beat.go:958 Exiting: can not convert 'object' into 'string' accessing '0.hosts.0' (source:'C:\ProgramData\Elastic\Beats\metricbeat\modules.d\auto-auth.yml')