# Packetbeat refuses to start - yaml error
**URL:** https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608
**Category:** Beats
**Tags:** packetbeat
**Created:** [March 7, 2016, 1:22am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608 "2016-03-07T01:22:54Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@bluethundr](https://discuss.elastic.co/u/bluethundr)
#### Post date: [March 7, 2016, 1:22am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608/1 "2016-03-07T01:22:54Z")
Hey guys,
I've had a decent set of beats configs distributed by puppet and running well for oh about a month at this point. When suddenly packetbeat as of yesterday stopped functioning. There were know known changes. Must be solar winds or something.
Anyway, when I stopped puppet on one of the hosts and ran packetbeat manually it refused to start. I tried starting it with the service first. Then completely manually after that failed.
This is what I got when I tried it manually:
```auto
[root@web1:~] #/usr/bin/packetbeat -c /etc/packetbeat/packetbeat.yml
Loading config file error: YAML config parsing failed on /etc/packetbeat/packetbeat.yml: yaml: unmarshal errors:
line 20: cannot unmarshal !!seq into outputs.MothershipConfig
line 21: cannot unmarshal !!str `http` into outputs.MothershipConfig
line 22: cannot unmarshal !!str `admin` into outputs.MothershipConfig
line 23: cannot unmarshal !!str `secretpass` into outputs.MothershipConfig
line 24: cannot unmarshal !!str `packetb...` into outputs.MothershipConfig. Exiting.
```
Odd so I tried parsing the file using some online yaml parsers. I tried parsing the config both here:
[codebeautify.org](http://codebeautify.org/yaml-validator)
And here:
[yaml-online-parser.appspot.com](http://yaml-online-parser.appspot.com/)
And the file passed both times with both yaml parsers. Here's my config file that's generating the error:
```auto
interfaces:
device: any
protocols:
dns:
ports: [53]
include_authorities: true
include_additionals: true
http:
ports: [80, 443, 5000]
memcache:
ports: [11211, 11212]
mysql:
ports: [3306]
pgsql:
redis:
thrift:
ports: [9042]
output:
elasticsearch:
hosts: ["logs.example.com:9200"]
protocol: "http"
username: "admin"
password: “secret”
index: "packetbeat-"
tls:
certificate_authorities: ["/etc/pki/CA/certs/ca.crt"]
shipper:
tags: ["jokefire-dev", "web-tier"]
logging:
```
I can't figure out why this file is generating these errors. Any help here would be appreciated!!
Thanks
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [March 7, 2016, 6:42am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608/2 "2016-03-07T06:42:29Z")
The settings under `elasticsearch:` need to be indented by one level more, like this:
```auto
interfaces:
device: any
protocols:
dns:
ports: [53]
include_authorities: true
include_additionals: true
http:
ports: [80, 443, 5000]
memcache:
ports: [11211, 11212]
mysql:
ports: [3306]
pgsql:
redis:
thrift:
ports: [9042]
output:
elasticsearch:
hosts: ["logs.example.com:9200"]
protocol: "http"
username: "admin"
password: “secret”
index: "packetbeat-"
tls:
certificate_authorities: ["/etc/pki/CA/certs/ca.crt"]
shipper:
tags: ["jokefire-dev", "web-tier"]
logging:
```
---
### Author:  [@bluethundr](https://discuss.elastic.co/u/bluethundr)
#### Post date: [March 8, 2016, 4:37am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608/3 "2016-03-08T04:37:07Z")
@tudor Excellent!! Thanks!! It's working now. Appreciate the tip! 😃
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608/4 "2017-07-05T21:54:50Z")