Skip to content
This repository was archived by the owner on Mar 18, 2022. It is now read-only.

config test error error initializing processors #4

Description

@CodeNameTheOnlyOne

downloaded new config and am getting
Exiting: error initializing processors: each processor must have exactly one action, but found 5 actions (script,when,lang,id,file)
winlogbeat v 7.16.3

i was able to get it to pass a config test by removing the following lines


  # As requested by our external CISO service
  - name: ForwardedEvents
    tags: [forwarded]
    processors:
      - script:
        when.equals.winlog.channel: Security
        lang: javascript
        id: security
        file: ${path.home}/module/security/config/winlogbeat-security.js
      - script:
        when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
        lang: javascript
        id: sysmon
        file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
      - script:
        when.equals.winlog.channel: Windows PowerShell
        lang: javascript
        id: powershell
        file: ${path.home}/module/powershell/config/winlogbeat-powershell.js
      - script:
        when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
        lang: javascript
        id: powershell
        file: ${path.home}/module/powershell/config/winlogbeat-powershell.js


# General processors
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

# Add JS Infos
processors:
  - script:
    when.equals.winlog.channel: Security
    lang: javascript
    id: security
    file: ${path.home}/module/security/config/winlogbeat-security.js

processors:
  - script:
    when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
    lang: javascript
    id: sysmon
    file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

  - script:
    when.equals.winlog.channel: Microsoft-Windows-Sysmon
    lang: javascript
    id: sysmon
    file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

processors:
  - script:
    when.equals.winlog.channel: Windows PowerShell
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: Microsoft-Windows-PowerShell/Admin
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: Microsoft-Windows-PowerShell
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: Microsoft-Windows-Shell-Core
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: PowerShellCore/Operational
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - script:
    when.equals.winlog.channel: PowerShellCore
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

basically every mention of lang:

otherwise i am happy with the file.
thanks.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions