# Please Help Newbie with default auditbeat YML did not find expected key?

**URL:** https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101
**Category:** Beats
**Tags:** auditbeat
**Created:** [September 27, 2020, 6:40pm UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101 "2020-09-27T18:40:20Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)
#### Post date: [September 27, 2020, 6:40pm UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/1 "2020-09-27T18:40:20Z")

</div>

Default auditbeat YML has the following error prevented from setup and execute.

PS C:\Program Files\auditbeat\> ./auditbeat setup  
./auditbeat -e  
./auditbeat : Exiting: error loading config file: yaml: line 102: did not find expected key  
At line:1 char:1

- ./auditbeat setup
- 

```auto
  + CategoryInfo : NotSpecified: (Exiting: error ...nd expected key:String) [], RemoteException
  + FullyQualifiedErrorId : NativeCommandError

```

./auditbeat : Exiting: error loading config file: yaml: line 102: did not find expected key  
At line:2 char:1

- ./auditbeat -e
- 

```auto
  + CategoryInfo : NotSpecified: (Exiting: error ...nd expected key:String) [], RemoteException
  + FullyQualifiedErrorId : NativeCommandError

```

LINE 102 is bolded with below. Why default YML has problem?. Please help

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

# Array of hosts to connect to. -------------- LIne 102

---

<div class="post-metadata">

### Author: ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [September 27, 2020, 9:18pm UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/2 "2020-09-27T21:18:31Z")

</div>

Hi Tony,  
Could you send the full auditbeat.yml configuration? it would be much easier to troubleshoot.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 27, 2020, 10:05pm UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/3 "2020-09-27T22:05:40Z")

</div>

And please format the yml with the `</>`above

---

<div class="post-metadata">

### Author: ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)
#### Post date: [September 28, 2020, 1:00am UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/4 "2020-09-28T01:00:04Z")

</div>

Borna - thanks. Solved to the wrong elastic:password. Thanks again

---

<div class="post-metadata">

### Author: ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)
#### Post date: [September 28, 2020, 1:00am UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/5 "2020-09-28T01:00:57Z")

</div>

Stephenb - Solved to the wrong elastic:password. Thanks again

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 28, 2020, 1:11am UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/6 "2020-09-28T01:11:19Z")

</div>

Those pesky passwords 😉

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 26, 2020, 3:11am UTC](https://discuss.elastic.co/t/please-help-newbie-with-default-auditbeat-yml-did-not-find-expected-key/250101/7 "2020-10-26T03:11:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
