When trying to run filebeat setup Exiting: 1 error: error loading config file

Elastic Stack Beats
1

Hello I just want to preface this with the fact that I am running an older version of beats, version 7.7.1, it's in production and we don't have a schedule yet to upgrade so we are stuck at this version for now.

Whenever I run filebeat setup -e
I get this error and the filebeat setup does not continue:

Setting up ML using setup --machine-learning is going to be removed in 8.0.0. Please use the ML app instead.
See more: Machine learning anomaly detection | Elastic Stack Overview [7.4] | Elastic
2021-05-27T14:23:42.631Z INFO eslegclient/connection.go:84 elasticsearch url: https://somenode.com:9300
2021-05-27T14:23:42.631Z INFO eslegclient/connection.go:84 elasticsearch url: https://somenode.com:9300
2021-05-27T14:23:42.643Z INFO [esclientleg] eslegclient/connection.go:263 Attempting to connect to Elasticsearch version 7.7.1
2021-05-27T14:23:42.643Z INFO kibana/client.go:118 Kibana url: https://dashboard-p1.lucd.ai:443/s/logging-and-monitoring
2021-05-27T14:23:42.710Z WARN fileset/modules.go:419 X-Pack Machine Learning is not enabled
2021-05-27T14:23:42.730Z WARN fileset/modules.go:419 X-Pack Machine Learning is not enabled
2021-05-27T14:23:42.749Z WARN fileset/modules.go:419 X-Pack Machine Learning is not enabled
2021-05-27T14:23:42.769Z WARN fileset/modules.go:419 X-Pack Machine Learning is not enabled
2021-05-27T14:23:42.769Z ERROR instance/beat.go:932 Exiting: 1 error: error loading config file: invalid config: yaml: line 3: did not find expected key
Exiting: 1 error: error loading config file: invalid config: yaml: line 3: did not find expected key

  # ============================== Filebeat inputs ===============================
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
 
# ============================== Filebeat modules ==============================
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

# ======================= Elasticsearch template setting =======================
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

# ================================= Dashboards =================================
setup.dashboards.enabled: true

# =================================== Kibana ===================================
setup.kibana:
  host: https://somedashboard.com
  space.id: logging-and-monitoring

# =========================== Elasticsearch Output =============================
output.elasticsearch:
  hosts: ["somenode1.com:9300", "somenode2.com:9300"]
  protocol: https
  username: someuser
  password: somepassword

# ================================= Processors =================================
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

# ================================== Logging ===================================
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  rotateeverybytes: 10485760
  keepfiles: 7
  permissions: 0644

# ============================= X-Pack Monitoring ==============================
xpack:
 monitoring:
  enabled: true
2

Could you check the indentation of this file? It looks like the first line is shifted a bit.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.