Parameter is missing in config for application/json content-type file Filebeat S3

Elastic Stack Beats
1

Hello,

I face some issues with Filebeat, I installed it et and configure the Filebeat.yml but when i run filbeat with the command : ./filebeat -e i have this errors and no results are found in Kibana

**2020-07-16T11:09:57.278+0200    ERROR   [s3]    s3/input.go:442 expand_event_list_from_field parameter is missing in config for application/json content-type file
**    2020-07-16T11:09:57.278+0200    ERROR   [s3]    s3/input.go:395 createEventsFromS3Info failed processing file from s3 bucket "bucket-elk-organization-**********" with name "AWSLogs/o-id3joo1z8x/************/CloudTrail/us-west-2/2020/07/12/************_CloudTrail_us-west-2_20200712T1930Z_4eBUqY88Zw6fvdJJ.json.gz": expand_event_list_from_field parameter is missing in config for application/json content-type file**`

Note: i installed filebeat in the same instance as logstash i think it's must be mentionned

Can you please help me ?

2

Hi!

It seems it is already tracked at Filebeat s3 cannot parse jsonl file who's content-type is set to application/json and there is already a WIP fix for it.

C.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.