Yaml: found character that cannot start any token when value starts with "@"

[joecullin.skout (Joe Cullin)]

Using o365 filebeat module. Getting this error:

cfgfile/list.go:99 Error creating runner from config: Error getting config for fileset o365/audit: Error reading input config: yaml: line 12: found character that cannot start any token

I only get it for an o365 tenant where the var.client_secret value starts with an "@" symbol.

I'm wrapping the value in quotes, so it's valid yaml. (Tried single quotes too.) I wrote a tiny go program using gopkg.in/yaml.v2 to verify that it's not a problem with the underlying module. Is beats doing something like reading in my file, merging it, then writing it out again? (And getting an error on its merged file?)

Here's a sample config file that causes the error:

- module: o365
  audit:
    enabled: true
    var.application_id: "xxx"
    var.tenants:
      - id: "xxx"
        name: "xxx"
    var.client_secret: "@/xxx"

It's not the usual tabs vs spaces or anything like that. We have hundreds of other customers' configs that work with the same file format. So far I've only seen the error when the secret starts with @.

[Marius_Iversen]

Hey @joecullin.skout

Il take a look around and see what we can do, it most likely has something to do with how the configuration is parsed, seeing as the error is logged by cfgfile, each module has a config template, using mustache, and your values entered in o356.yml seems to hit an issue when these values are being mapped to the template.

Will update you on the topic once I have more, but in the meantime the secret will unfortunately have to be changed.

Added this issue for tracking purposes: [Filebeat][O365 Module] client_secret produces error if secret starts with @ · Issue #25058 · elastic/beats · GitHub