"event_id:" can't work properly! (solved: config indentation)

(Jason) #1

I like to configure "Winlogbeat" for filter my Event ID. I added below line to my config file:

- name: Security
   event_id: 4663,4660

But when I want to start service then I got below error:

How can I solve it?

Thank you.

(Jason) #2

Problem solved. It is sensitive to space and must be below of "name:".

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.