Filebeat "error loading config file: yaml: did not find expected key"

Question

Im stacked at this issue.

I have an Elasticsearch server with x-pack security enabled. A client with Filebeat that is sending outputs to that server. All is working fin without enabling x-pck security, but whe doing it, in the lient I have this error message.

./filebeat test config -v
Exiting: error loading config file: yaml: line 157: did not find expected key

The line that causes the error is the "username" and "password". When commented, the config test is OK, but when username and password is uncommented the error appears

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch.hosts: ["X.X.X.X:9200"]

  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Protocol - either `http` (default) or `https`.
  #protocol: "http"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "<password_generated_in_server>"

Connection is working fine with a XGET request like this:

curl -XGET 'http://X.X.X.X:9200/_all/_search?q=*&pretty' -u elastic:<password_generated_in_server>

Do I need to acivate any x-pack module, option or create the user manually?

My enabled modules are system, elasticsearch and auditd. Im using a go build for arm in the client.

Thanks

Solution

Solved.

It seems the configuration file is pretty strict in the syntax... This way is working fine:

setup.kibana:
  host: "http://X.X.X.X:5601"

output.elasticsearch:
  hosts: ["http://X.X.X.X:9200"]
  username: "elastic"
  password: "<passwd>"

Comments

[Chris]

I had the same issue and could only add 1 output.something section. I could not put it on 2 separate lines like: ``` output: elasticsearch: ```