🚨 Filebeat Error Guide: 'Error creating runner from config' — Fix Invalid Input Settings

Overview

Filebeat emits this when it parses your configuration successfully as YAML but then fails to construct a working input (a “runner”) from one of the input blocks. The message usually carries a nested reason after the colon:

Error creating runner from config: unable to create runner due to error: 1 error: accessing 'fields' key on filebeat input config: expected a map but got string

The YAML is syntactically valid, so filebeat test config may even pass — but a specific input has an option with the wrong type, an unknown setting, a broken processor, or a missing required field. Because the runner cannot be built, that entire input never starts. Depending on Filebeat version and whether it is a fatal error, Filebeat may exit or may start the other inputs and skip the broken one.

Symptoms

• Filebeat fails to start (older/strict versions) or one input is silently missing while others run.
• The log line always contains Error creating runner from config: followed by a more specific nested error.
• filebeat test config reports OK (it checks YAML shape, not full runner construction) but startup still fails.
• The error names a config key such as fields, multiline, processors, or parsers.
• The problem appeared right after editing an input block or adding a processor.

Common Root Causes

• Wrong value type for a key — e.g. fields: given a string instead of a map, or close_inactive: 5 instead of 5m.
• Unknown / misspelled option — a typo like paths: instead of paths:, or an option that belongs to a different input type.
• Broken processor definition under the input’s processors: list (bad condition, wrong field type).
• Missing required field — a filestream input without an id, or a module input missing a mandatory setting.
• Deprecated option removed in your version — a setting that worked on Filebeat 7 but was dropped in 8.x.

Diagnostic Workflow

Read the nested part of the error first — it names the offending key. Then validate the specific input in isolation.

filebeat test config -c /etc/filebeat/filebeat.yml
filebeat -e -c /etc/filebeat/filebeat.yml       # foreground; the nested reason prints in full

Reduce the config to the single suspect input to confirm it is the culprit:

# /etc/filebeat/test-input.yml
filebeat.inputs:
  - type: filestream
    id: app
    paths:
      - /var/log/app/*.log
    fields:                 # MUST be a map, not a string
      service: app
      env: prod
    fields_under_root: true
output.console:
  pretty: true

filebeat -e -c /etc/filebeat/test-input.yml -d "input"   # verbose input debug logs

Confirm allowed options for your version against the docs, and diff against a known-good block:

filebeat version
filebeat export config -c /etc/filebeat/filebeat.yml     # print the fully-resolved config

Example Root Cause Analysis

An engineer added per-input metadata but wrote it as a scalar:

- type: filestream
  id: nginx
  paths: ["/var/log/nginx/access.log"]
  fields: "service=nginx"      # BUG: string, not a map

Filebeat parsed the YAML fine, but building the runner failed with accessing 'fields' key ... expected a map but got string. The fields option must be a key/value map. Correcting it fixed startup:

  fields:
    service: nginx

The tell was in the nested error text: expected a map but got string on the fields key. Reading past the generic Error creating runner from config: prefix pointed straight at the fix.

Prevention Best Practices

• Always read the nested reason after the colon — the generic prefix is never the actual problem.
• Keep each input block minimal and add options one at a time, validating with filebeat test config after each change.
• Give every filestream input a unique, stable id — it is required and prevents state confusion.
• Pin your config to the Filebeat major version’s documented options; re-check option names after every major upgrade.
• Store configs in version control and run filebeat test config in CI so bad types never reach production.

Quick Command Reference

filebeat test config                              # validate YAML + basic schema
filebeat -e -c filebeat.yml                        # foreground run, full nested error
filebeat -e -c test-input.yml -d "input"           # isolate one input with debug logs
filebeat export config                             # print fully-resolved effective config
filebeat version                                   # confirm which option set applies

Conclusion

Error creating runner from config means your YAML is valid but one input cannot be assembled into a working reader. The fix is always in the nested reason after the prefix — a wrong type, an unknown key, a broken processor, or a missing required field. Isolate the suspect input into a tiny standalone config, run Filebeat in the foreground to read the full error, and correct the named key. Validating configs in CI with filebeat test config stops these from ever reaching a running node.