Problem with ansible-beats and processors config

Hi there! I am trying to install/configure filebeat with the ansible role from elastic.
My playbook looks like this:

- hosts: filebeat_hosts
  roles:
    - role: role-beats
  vars:
    use_repository: true
    beats_version: 6.8.5
    beat: filebeat
    beat_conf:
      inputs:
        - type: log
          enabled: false
          paths:
        - type: docker
          enabled: true
          containers.ids: '*'

      filebeat.config.modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: false

      setup.template.settings:
        index.number_of_shards: 3

      processors:
        - add_locale: ~
        - add_host_metadata: ~
        - add_cloud_metadata: ~
        - add_docker_metadata: ~

After running ansible-playbook with this the result on my host is fine with the exception of the processors section. It results in:

processors:
- add_locale: null
- add_host_metadata: null
- add_cloud_metadata: null
- add_docker_metadata: null

This is AFAIK normal since ansible/jinja2 is treating the ~ as an alias for null.
Escaping the ~ with single or double quotes results in this:

processors:
- add_locale: '~'
- add_host_metadata: '~'
- add_cloud_metadata: '~'
- add_docker_metadata: '~'

but filebeat then complaints with this message when trying to start and finally stops starting:

Exiting: error unpacking config data: required 'object', but found 'string' in field 'processors.0.add_locale' (source:'/etc/filebeat/filebeat.yml')

Any idea, how to configure this section with ansible?

Cheers, Martin

1 Like

If I had to take a guess, I would say the escaping isn't working properly. You should get a config object like this:

processors:
- add_locale: ~

Note the lack of single quotes.

Exactly my opinion... but I was and am not able to make this work and produce the correct values in the config...

BTW: the template used (the original from elastic) uses the content of the content hash in this way:

{{ beat_conf | to_nice_yaml(indent=2) }}

Sorry, I edited my inital message. The formatting was garbled. Now it is like in my ansible playbook...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.