# Winlogbeat: Error loading config file:Type "String" is not supported on top level of config

**URL:** <https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 9, 2020, 6:56pm UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860 "2020-05-09T18:56:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vi\_Hung\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vi_hung_tr_n/32/68027_2.png) [@Vi\_Hung\_Tr\_n](https://discuss.elastic.co/u/Vi_Hung_Tr_n)\
**Post date:** [May 9, 2020, 6:56pm UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/1 "2020-05-09T18:56:22Z")

</div>

![winlogbeat](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49f95563913c38724c7060e018de68e5b2dfa488.png)

Hi Guys, i had a problems while config the winlogbeat.yml file in Winlogbeat folder to make it send log to Logstash but it came back with the above errors, so i hop someone that have the similar problem to me can solve this, thanks

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 10, 2020, 12:50pm UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/2 "2020-05-10T12:50:16Z")

</div>

Hey @Vi_Hung_Tr_n welcome to discuss 🙂

This looks like a problem with the `winlogbeat.yml` configuration file, could you share it?

---

<div class="post-metadata">

**Author:** ![Vi\_Hung\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vi_hung_tr_n/32/68027_2.png) [@Vi\_Hung\_Tr\_n](https://discuss.elastic.co/u/Vi_Hung_Tr_n)\
**Post date:** [May 12, 2020, 5:03pm UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/3 "2020-05-12T17:03:14Z")

</div>

Hi Jaime, thanks for reply my problem.  
Sorry for replying you so late  
Here is my winlogbeat.yml file on my Windows server 2008 R2 Host:

> **[winlogbeat.yml](https://drive.google.com/file/d/1DDIkMsN5OCtePhJzRC8H3nEDX6rVc4B-/view?usp=drive_open)**
>
> Google Drive file.

i only change the logstash host ip into my ELK server.  
Other config i follow the tutortial which i've found on [Eslatic.co](http://Eslatic.co) :[https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html)  
Don't know i have done wrong something.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 12, 2020, 6:00pm UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/4 "2020-05-12T18:00:22Z")

</div>

Hey @Vi_Hung_Tr_n,

Could you try quoting the values where you are using variables, for example here:

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    processors:
      - script:
          lang: javascript
          id: security
          file: '${path.home}/module/security/config/winlogbeat-security.js'

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: '${path.home}/module/sysmon/config/winlogbeat-sysmon.js'

```

---

<div class="post-metadata">

**Author:** ![Vi\_Hung\_Tr\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vi_hung_tr_n/32/68027_2.png) [@Vi\_Hung\_Tr\_n](https://discuss.elastic.co/u/Vi_Hung_Tr_n)\
**Post date:** [May 26, 2020, 8:27am UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/5 "2020-05-26T08:27:31Z")

</div>

Dear Jaime, thanks , I've solved this problem by re-install the whole stack plus Winlogbeat

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2020, 8:27am UTC](https://discuss.elastic.co/t/winlogbeat-error-loading-config-file-type-string-is-not-supported-on-top-level-of-config/231860/6 "2020-06-23T08:27:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.