"event_id:" can't work properly! (solved: config indentation)

Elastic Stack Beats
1

Hello.
I like to configure "Winlogbeat" for filter my Event ID. I added below line to my config file:

- name: Security
   event_id: 4663,4660

But when I want to start service then I got below error:
winlogbeat

How can I solve it?

Thank you.

2

Problem solved. It is sensitive to space and must be below of "name:".

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.