# Yaml: found character that cannot start any token when value starts with "@"

**URL:** <https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 10, 2021, 4:40pm UTC](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778 "2021-04-10T16:40:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joecullin.skout](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@joecullin.skout](https://discuss.elastic.co/u/joecullin.skout)\
**Post date:** [April 10, 2021, 4:40pm UTC](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778/1 "2021-04-10T16:40:22Z")

</div>

Using o365 filebeat module. Getting this error:

> cfgfile/list.go:99 Error creating runner from config: Error getting config for fileset o365/audit: Error reading input config: yaml: line 12: found character that cannot start any token

I only get it for an o365 tenant where the var.client\_secret value starts with an "@" symbol.

I'm wrapping the value in quotes, so it's valid yaml. (Tried single quotes too.) I wrote a tiny go program using gopkg.in/yaml.v2 to verify that it's not a problem with the underlying module. Is beats doing something like reading in my file, merging it, then writing it out again? (And getting an error on its merged file?)

Here's a sample config file that causes the error:

```auto
- module: o365
  audit:
    enabled: true
    var.application_id: "xxx"
    var.tenants:
      - id: "xxx"
        name: "xxx"
    var.client_secret: "@/xxx"

```

It's not the usual tabs vs spaces or anything like that. We have hundreds of other customers' configs that work with the same file format. So far I've only seen the error when the secret starts with @.

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 13, 2021, 11:56pm UTC](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778/2 "2021-04-13T23:56:12Z")

</div>

Hey @joecullin.skout 🙂

Il take a look around and see what we can do, it most likely has something to do with how the configuration is parsed, seeing as the error is logged by `cfgfile`, each module has a config template, using mustache, and your values entered in o356.yml seems to hit an issue when these values are being mapped to the template.

Will update you on the topic once I have more, but in the meantime the secret will unfortunately have to be changed.

Added this issue for tracking purposes: [[Filebeat][O365 Module] client\_secret produces error if secret starts with @ · Issue #25058 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/25058)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2021, 1:57am UTC](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778/3 "2021-05-12T01:57:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.