Filebeat fails to start for multiple prospectors(Exiting: error loading config file: yaml: line 16: did not find expected key)

Elastic Stack Beats
1

I configured filebeat to pull two types of log files and my config looks something like this.

filebeat:
  prospectors:
  - input_type: log
    paths:
        - C:\softwares\syslog
      fields:  {log_type: syslog}
   - input_type: log 
      paths:
        - C:\softwares\cdr_test.log
      fields: {log_type: cdr}

However I am getting error saying did not find the key. I am not able to find the point of error.
Any inputs are appreciated. Thank you in advance for the assistance.

2

Please use the </> button to format config files and logs.

YAML is sensitive to indentation. That is, do use spaces and no tabs and try to indent with exactly 2 spaces per level. The formatting in your sample config looks completely off.

corrected (filebeat 5.x required)

filebeat.prospectors:
- input_type: log
  paths:
    - 'C:\softwares\syslog'
  fields.log_type: syslog
- input_type: log 
  paths:
    - 'C:\softwares\cdr_test.log'
  fields.log_type: cdr

interestingly you don't have 16 lines in your sample, so the parsing might finally (well, it's already off) break somewhat later in your config file.

3

This looks like an indentation problem with your YAML config. Try your config on http://www.yamllint.com/ and you will see that it's not valid YAML.

(edit: I removed my corrected config since steffens and I both replied at the same time.)

4

Thanks a lot for the assistance @ both. Yes it was indentation problem. Working fine now.