As figured out in #2, when there's an error in the config file, packetbeat logs that it will use the defaults. However, the following pcap.Openlive fails to open device:
# packetbeat -e -c /root/packetbeat.conf
TOML config parsing failed on /root/packetbeat.conf: Near line 21, key 'protocols.http.ports': Near line 21: Expected an array value terminator ',' or an array terminator ']', but got '8' instead.. We will use defaults.
main.go:225: ERR pcap.Openlive failed(): : No such device exists (SIOCGIFHWADDR: No such device))
I don't find any reference to defaults in the code either, but I've never used toml before...
Thanks
Stephan
As figured out in #2, when there's an error in the config file, packetbeat logs that it will use the defaults. However, the following pcap.Openlive fails to open device:
I don't find any reference to defaults in the code either, but I've never used toml before...
Thanks
Stephan