Filebeat ConfigTest

[root@ip-192-168-1-61 bin]# uname -a
Linux ip-192-168-1-61.ec2.internal 3.10.0-514.21.2.el7.x86_64 #1 SMP Sun May 28 17:08:21 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux
[root@ip-192-168-1-61 bin]# sudo filebeat.sh -e -d "*" -configtest
filebeat2017/07/09 10:26:04.378843 beat.go:339: CRIT Exiting: error loading config file: yaml: line 11: found a tab character that violate indentation
Exiting: error loading config file: yaml: line 11: found a tab character that violate indentation
[root@ip-192-168-1-61 bin]# sudo cat /etc/filebeat/filebeat.yml
filebeat:
  prospectors:
    -
      paths:
        - /var/log/*.json
      #  - /var/log/messages
      #  - /var/log/*.log

      input_type: log

      document_type: syslog
        json.keys_under_root: true
        json.add_error_key: true


  registry_file: /var/lib/filebeat/registry

output:
  logstash:
    hosts: ["192.168.1.61:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10MB
[root@ip-192-168-1-61 bin]# ps -ef | grep filebeat
root     20029 18810  0 06:26 pts/0    00:00:00 grep --color=auto filebeat
[root@ip-192-168-1-61 bin]# sudo systemctl status filebeat.service
● filebeat.service - filebeat
   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Sun 2017-07-09 06:25:47 EDT; 1min 2s ago
     Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 19867 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
 Main PID: 19867 (code=exited, status=1/FAILURE)

Jul 09 06:25:46 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Jul 09 06:25:46 ip-192-168-1-61.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Jul 09 06:25:46 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service failed.
Jul 09 06:25:47 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service holdoff time over, scheduling restart.
Jul 09 06:25:47 ip-192-168-1-61.ec2.internal systemd[1]: start request repeated too quickly for filebeat.service
Jul 09 06:25:47 ip-192-168-1-61.ec2.internal systemd[1]: Failed to start filebeat.
Jul 09 06:25:47 ip-192-168-1-61.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Jul 09 06:25:47 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service failed.
[root@ip-192-168-1-61 bin]# sudo systemctl stop filebeat.service
[root@ip-192-168-1-61 bin]# sudo rm /var/lib/filebeat/registry
[root@ip-192-168-1-61 bin]# sudo filebeat.sh -e
filebeat2017/07/09 10:27:27.196040 beat.go:339: CRIT Exiting: error loading config file: yaml: line 11: found a tab character that violate indentation
Exiting: error loading config file: yaml: line 11: found a tab character that violate indentation
[root@ip-192-168-1-61 bin]# sudo systemctl start filebeat.service
[root@ip-192-168-1-61 bin]# sudo systemctl status filebeat.service
● filebeat.service - filebeat
   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Sun 2017-07-09 06:27:39 EDT; 4s ago
     Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 20220 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
 Main PID: 20220 (code=exited, status=1/FAILURE)

Jul 09 06:27:38 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Jul 09 06:27:38 ip-192-168-1-61.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Jul 09 06:27:38 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service failed.
Jul 09 06:27:39 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service holdoff time over, scheduling restart.
Jul 09 06:27:39 ip-192-168-1-61.ec2.internal systemd[1]: start request repeated too quickly for filebeat.service
Jul 09 06:27:39 ip-192-168-1-61.ec2.internal systemd[1]: Failed to start filebeat.
Jul 09 06:27:39 ip-192-168-1-61.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Jul 09 06:27:39 ip-192-168-1-61.ec2.internal systemd[1]: filebeat.service failed.
[root@ip-192-168-1-61 bin]# tail -100 /var/log/filebeat/filebeat
2017-07-09T06:22:58-04:00 INFO Setup Beat: filebeat; Version: 5.4.3
2017-07-09T06:22:58-04:00 INFO Max Retries set to: 3
2017-07-09T06:22:58-04:00 INFO Activated logstash as output plugin.
2017-07-09T06:22:58-04:00 INFO Publisher name: ip-192-168-1-61.ec2.internal
2017-07-09T06:22:58-04:00 INFO Flush Interval set to: 1s
2017-07-09T06:22:58-04:00 INFO Max Bulk Size set to: 1024
[root@ip-192-168-1-61 bin]#