🚨 Filebeat Error Guide: 'Failed to create input: unknown input type' — Fix Invalid Input Types

Overview

Filebeat throws this when an input block declares a type: that the running Filebeat binary does not recognize:

Exiting: Failed to create input: unknown input type: filestreams, please check your configuration

Every Filebeat input block starts with a type: key — filestream, log, container, journald, tcp, udp, syslog, and so on. At startup Filebeat looks up a registered input factory for that exact string. If the type is misspelled, has been removed or renamed in your Filebeat version, or refers to a plugin that isn’t compiled into this build, the lookup fails and Filebeat exits. Nothing is harvested because the input can’t even be constructed.

Symptoms

• Filebeat exits at startup with unknown input type: <value>.
• The <value> in the error is a close-but-wrong spelling of a real type (e.g. filestreams, logs, docker).
• The config worked on a different Filebeat major version.
• A module or input that existed in Filebeat 7 is missing after upgrading to 8.x.
• filebeat test config passes (valid YAML) but startup still fails on the type lookup.

Common Root Causes

• Misspelled type — filestreams, file-stream, Log, or trailing whitespace after the value.
• Version-removed or renamed type — docker input was deprecated in favor of container; some inputs changed names across majors.
• Type belongs to a different Beat — copying a Metricbeat/Winlogbeat snippet whose input type Filebeat doesn’t provide.
• Case sensitivity — types are lowercase; Filestream won’t match filestream.
• A custom build without the expected input compiled in.

Diagnostic Workflow

Confirm the exact string Filebeat received, then check it against the valid types for your version.

filebeat version
grep -n 'type:' /etc/filebeat/filebeat.yml       # find the declared input types
filebeat export config -c /etc/filebeat/filebeat.yml | grep -n 'type:'

Use a correct, minimal input to prove the type is the problem:

# /etc/filebeat/filebeat.yml
filebeat.inputs:
  - type: filestream        # valid, lowercase, exact spelling
    id: app
    paths:
      - /var/log/app/*.log
output.console:
  pretty: true

filebeat test config -c /etc/filebeat/filebeat.yml
filebeat -e -c /etc/filebeat/filebeat.yml         # confirm it starts with the corrected type

Cross-check the supported input names for your major version in the Elastic docs (filebeat.inputs reference) before deploying.

Example Root Cause Analysis

After a copy-paste from an internal wiki, an input block read:

- type: filestreams        # BUG: trailing 's'
  id: app
  paths: ["/var/log/app/*.log"]

Filebeat exited with unknown input type: filestreams. The YAML was valid, so test config gave no warning about it, but the type lookup failed because the correct identifier is the singular filestream. Removing the s fixed startup immediately:

- type: filestream

A parallel case on another host was a Filebeat 8 upgrade where an old type: docker block needed to become type: container — the docker input had been removed in 8.x.

Prevention Best Practices

• Use lowercase, exact input-type names and check the Elastic input reference for your specific Filebeat major version.
• After a major upgrade, review the breaking-changes notes for renamed or removed input types (e.g. docker -> container).
• Don’t paste input blocks from other Beats — only Filebeat’s input types are valid in filebeat.yml.
• Watch for trailing whitespace or stray characters after the type value.
• Keep configs in version control and validate against a matching Filebeat version in CI.

Quick Command Reference

filebeat version                                  # know which type set applies
grep -n 'type:' /etc/filebeat/filebeat.yml         # list declared types
filebeat export config | grep 'type:'              # see resolved types
filebeat test config                               # YAML validity
filebeat -e -c filebeat.yml                         # confirm corrected type starts
# valid examples: filestream, log, container, journald, tcp, udp, syslog

Conclusion

Failed to create input: unknown input type is a name-lookup failure: the type: string doesn’t match any input the running Filebeat provides. It’s almost always a misspelling, a case/whitespace slip, or a type that was renamed/removed in your Filebeat version. Print the resolved types, compare them to the version’s input reference, and correct the value. Validating against the matching Filebeat version in CI catches these before they reach a node.