Windows sidecar filebeat 'exiting: no modules or inputs enabled'

Graylog Central (peer support)
, ,
8

oooh … here is another thing I missed… You also need a dash in front of type:

filebeat:
  inputs:
    - type: log
      enabled: true

Fingers crossed that’s it! Below is a working filebeat I use for watching Owa… hopefully it will help too:

# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}
output.logstash:
   hosts: 
   - ${user.BeatsInput}
   ssl:
   verification_mode: none
path:
  data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - windows, exchange, filebeat, OWA, e-mail
filebeat:
  inputs:
    - type: log
      enabled: true
      # find owa logon and logoff but not when the HealthMailbox does it.
      include_lines: ['auth.owa', 'logoff.owa']
      exclude_lines: ['HealthMailbox','^#']
      paths:
        - C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa\*.LOG