filebeat config pure_hash

[cdenneen]

@pcfens currently using the pure_hash to create a filebeat.yml file.
How can I do this with params that aren't part of the module?

class {'filebeat':
  queue => {
    mem => {
      events => '8192',
      flush => {
        min_events => '512',
        timeout => '1s'
      }
    }
  }
}

Puppet::ParseError:
     #   Class[Filebeat]: has no parameter named 'queue'

I'd prefer to do this in hiera but open to other options like above.

[cdenneen]

@pcfens one stack seems fine but a different project getting a weird error... have to double check that they are both using same version of filebeat but was wondering if you understood this error or saw before:

change from '{md5}7a06884cdb4def506762a3b68c15e7e0' to '{md5}5ebfe380d95e3fd6a6cc483640a8c99b' failed: Execution of '/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml20221212-10866-1qtel9y test config' returned 1: Exiting: error unpacking config data: more than one namespace configured accessing 'queue' (source:'/etc/filebeat/filebeat.yml20221212-10866-1qtel9y')

searched for similar error but haven't found anything in old issues.

From the puppet report I don't see a duplicate queue so not sure what it's complaining about:

--- /etc/filebeat/filebeat.yml 2022-12-12 19:17:37.937142936 +0000
+++ /tmp/puppet-file20221212-10866-10opsc7 2022-12-12 21:05:49.052877345 +0000
@@ -11,14 +11,21 @@
config.modules:
enabled: false
path: "/etc/filebeat/modules.d/*.yml"
- shutdown_timeout: '0'
modules: []
+ overwrite_pipelines: false
+ shutdown_timeout: '0'
registry:
path: "/var/lib/filebeat"
file_permissions: '0600'
flush: 0s
+ autodiscover: {}
http: {}
cloud: {}
+queue:
+ mem:
+ events: 8192
+ flush.min_events: 512
+ flush.timeout: 1s
output:
logstash:
hosts:
@@ -33,7 +40,6 @@
name: filebeat.log
keepfiles: 7
permissions: 420
-autodiscover: {}
runoptions: {}
processors: []
setup: {}

[cdenneen]

Disabling the config test yielded the following config which does NOT have a duplicate queue namespace so not sure why its giving that error:

### Filebeat configuration managed by Puppet ###
---
name: i-049250855ac809e99
tags: []
fields: {}
fields_under_root: false
filebeat:
  config.inputs:
    enabled: true
    path: "/etc/filebeat/conf.d/*.yml"
  config.modules:
    enabled: false
    path: "/etc/filebeat/modules.d/*.yml"
  modules: []
  overwrite_pipelines: false
  shutdown_timeout: '0'
  registry:
    path: "/var/lib/filebeat"
    file_permissions: '0600'
    flush: 0s
  autodiscover: {}
http: {}
cloud: {}
queue:
  mem:
    events: 8192
  flush.min_events: 512
  flush.timeout: 1s
output:
  logstash:
    hosts:
    - logstash-endpoint.example.com:5044
shipper: {}
logging:
  level: info
  to_files: true
  to_syslog: false
  files:
    path: "/var/log/filebeat"
    name: filebeat.log
    keepfiles: 7
    permissions: 420
runoptions: {}
processors: []
setup: {}