No such input type exist: 'etw'

Elastic Stack Beats
1

Hey there,

I was trying to test out the new ETW input in filebeat, but am only getting the following error message:

{"log.level":"error","@timestamp":"2024-04-17T14:37:11.214+0200","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1340},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: Error creating input. No such input type exist: 'etw'","service.name":"filebeat","ecs.version":"1.6.0"}

Tried with versions 8.13.1 & 8.13.2 and also different input definitions (following the examples at ETW input | elastic.co), all leading to the same error message.

As I'm using the OSS version and saw a different discussion which hinted at that being the culprit: is there a difference in the availability of input features?

2

Yes, there is, not everything will be available in the OSS version.

I don't think there is any list in the documentation, but you can check on the github repositoiry.

If i'm not wrong, these are the inputs available in all distributions (Elastic and OSS):

And these are the inputs available only on Elastic distribution:

As you can see, the etw input is under the x-pack path, which means that it needs a basic license at least.

1 Like