Problem with ansible-beats and processors config

Hi there! I am trying to install/configure filebeat with the ansible role from elastic.
My playbook looks like this:

- hosts: filebeat_hosts
    - role: role-beats
    use_repository: true
    beats_version: 6.8.5
    beat: filebeat
        - type: log
          enabled: false
        - type: docker
          enabled: true
          containers.ids: '*'

        path: ${path.config}/modules.d/*.yml
        reload.enabled: false

        index.number_of_shards: 3

        - add_locale: ~
        - add_host_metadata: ~
        - add_cloud_metadata: ~
        - add_docker_metadata: ~

After running ansible-playbook with this the result on my host is fine with the exception of the processors section. It results in:

- add_locale: null
- add_host_metadata: null
- add_cloud_metadata: null
- add_docker_metadata: null

This is AFAIK normal since ansible/jinja2 is treating the ~ as an alias for null.
Escaping the ~ with single or double quotes results in this:

- add_locale: '~'
- add_host_metadata: '~'
- add_cloud_metadata: '~'
- add_docker_metadata: '~'

but filebeat then complaints with this message when trying to start and finally stops starting:

Exiting: error unpacking config data: required 'object', but found 'string' in field 'processors.0.add_locale' (source:'/etc/filebeat/filebeat.yml')

Any idea, how to configure this section with ansible?

Cheers, Martin

1 Like

If I had to take a guess, I would say the escaping isn't working properly. You should get a config object like this:

- add_locale: ~

Note the lack of single quotes.

Exactly my opinion... but I was and am not able to make this work and produce the correct values in the config...

BTW: the template used (the original from elastic) uses the content of the content hash in this way:

{{ beat_conf | to_nice_yaml(indent=2) }}

Sorry, I edited my inital message. The formatting was garbled. Now it is like in my ansible playbook...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.