Closed leogoldim closed 4 years ago
Thanks for the issue! Looks like this is an issue with yaml indentation. You have:
processors:
- add_fields:
fields:
tenant: {company}
instead you need:
processors:
- add_fields:
fields:
tenant: {company}
Note the extra indentation for the fields
tree. This is tricky with yaml, it happens all the time. See the add_fields
processor docs for another few examples. Let me know if this fixes things for you, and we can close the issue. Otherwise we can dig a bit deeper. Thanks again!
Hi @chris-counteractive,
thank you for the quick feedback.
I fixed the indentation, but I got the same error.
Hmm. Okay, I noticed another issue in the config you posted, not sure if it's the cause, but worth eliminating: you have a standalone fields
section at the bottom, which might be a copy-paste error ... I don't think that's meaningful outside an add_fields
processor. I don't think it should cause problems, but it's a complicating factor and not necessary.
The only other thing that comes to mind is that your beat could still be reading the uncorrected config. You can export the config to test with o365beat export config
and check whether it's the one you corrected.
You can also run your config through a yaml-to-json converter and check for any un-desired "null" values, which can indicate an indentation issue. If it still has issues, could you re-post the latest redacted config so we're looking at the same thing? Thanks!
Hi, after test my config file with a yaml-to-json tool I realized that my secret had a character ("]") that broke the yaml syntax. I generated a new one and it's working now.
I'm glad you were able to solve your issue, thanks for following up. Yaml is tricky, for sure - in the future you can also avoid some of those edge cases by enclosing strings in single or double quotes:
client_secret: 'this_is_my-(wacky)-[secret]!@#'
Or by pulling your secrets from the environment or a keystore. Thanks again!
Hi,
I'm getting the error:
Exiting: error loading config file: yaml: line 2: did not find expected node content
When I try to start the o365beat.
# o365beat --path.config /etc/o365beat -c o365beat.yml -e -d "*" --strict.perms=false