This is my config
filebeat.prospectors:
- input_type: log
paths:
- /var/log/xaa
fields:
Host: ${HOSTNAME}
fields_under_root: true
document_type: nginx
tags: test
exclude_lines: ['GET / HTTP/1.1"']
processors:
- drop_fields.when:
- contains:
- Host: 'vm1'
- fields:
- "beat"
- "offset"
I use filebeat -c /etc/filebeat/filebeat.yml -path.logs /var/log/filebeat/ -path.data /var/lib/filebeat/ -configtest
The filebeat output
filebeat2017/07/24 10:12:14.974970 beat.go:339: CRIT Exiting: error loading config file: yaml: line 25: did not find expected key
Exiting: error loading config file: yaml: line 25: did not find expected key