- Packetbeat Reference: other versions:
- Overview
- Getting started with Packetbeat
- Setting up and running Packetbeat
- Upgrading Packetbeat
- Configuring Packetbeat
- Set traffic capturing options
- Set up flows to monitor network traffic
- Specify which transaction protocols to monitor
- Specify which processes to monitor
- Specify general settings
- Configure the internal queue
- Configure the output
- Configure index lifecycle management
- Specify SSL settings
- Filter and enhance the exported data
- Define processors
- Add cloud metadata
- Add fields
- Add labels
- Add the local time zone
- Add tags
- Decode JSON fields
- Drop events
- Drop fields from events
- Keep fields from events
- Rename fields from events
- Add Kubernetes metadata
- Add Docker metadata
- Add Host metadata
- Dissect strings
- DNS Reverse Lookup
- Add process metadata
- Parse data by using ingest node
- Enrich events with geoIP information
- Configure project paths
- Configure the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- HTTP Endpoint
- packetbeat.reference.yml
- Exported fields
- AMQP fields
- Beat fields
- Cassandra fields
- Cloud provider metadata fields
- Common fields
- DHCPv4 fields
- DNS fields
- Docker fields
- ECS fields
- Flow Event fields
- Host fields
- HTTP fields
- ICMP fields
- Kubernetes fields
- Memcache fields
- MongoDb fields
- MySQL fields
- NFS fields
- PostgreSQL fields
- Process fields
- Raw fields
- Redis fields
- Thrift-RPC fields
- TLS fields
- Transaction Event fields
- Measurements (Transactions) fields
- Monitoring Packetbeat
- Securing Packetbeat
- Visualizing Packetbeat data in Kibana
- Troubleshooting
- Contributing to Beats
YAML tips and gotchas
editYAML tips and gotchas
editThe configuration file uses YAML for its syntax. When you edit the file to modify configuration settings, there are a few things that you should know.
Use spaces for indentation
editIndentation is meaningful in YAML. Make sure that you use spaces, rather than tab characters, to indent sections.
In the default configuration files and in all the examples in the documentation, we use 2 spaces per indentation level. We recommend you do the same.
Look at the default config file for structure
editThe best way to understand where to define a configuration option is by looking at the provided sample configuration files. The configuration files contain most of the default configurations that are available for the Beat. To change a setting, simply uncomment the line and change the values.
Test your config file
editYou can test your configuration file to verify that the structure is valid.
Simply change to the directory where the binary is installed, and run
the Beat in the foreground with the test config
command specified. For
example:
packetbeat test config -c packetbeat.yml
You’ll see a message if the Beat finds an error in the file.
Wrap regular expressions in single quotation marks
editIf you need to specify a regular expression in a YAML file, it’s a good idea to wrap the regular expression in single quotation marks to work around YAML’s tricky rules for string escaping.
For more information about YAML, see http://yaml.org/.
Wrap paths in single quotation marks
editWindows paths in particular sometimes contain spaces or characters, such as drive letters or triple dots, that may be misinterpreted by the YAML parser.
To avoid this problem, it’s a good idea to wrap paths in single quotation marks.
Avoid using leading zeros in numeric values
editIf you use a leading zero (for example, 09
) in a numeric field without
wrapping the value in single quotation marks, the value may be interpreted
incorrectly by the YAML parser. If the value is a valid octal, it’s converted
to an integer. If not, it’s converted to a float.
To prevent unwanted type conversions, avoid using leading zeros in field values, or wrap the values in single quotation marks.
On this page