I'm looking to use Filebeat to ship logs to our ELK stack cluster.
Editing the yml file, I tried this kind of configuration:
fields: debug: true banana: split: chocolate
but when starting the beat it doesn't work:
CRIT Config error: Error reading config file: YAML config parsing failed on filebeat.yml: yaml: unmarshal errors: line 39: cannot unmarshal !!map into string. Exiting.
Is it possible to nest fields? If yes , how?
I would like to group related custom fields and refer to them in logstash with the [fields][banana][split] reference.