FIlebeat Output Configuration Error

[stephenb (Stephen Brown)]

I am confused you are saying linux logs

@dfir

I am trying to ingest standard auth.log(s) and syslogs from a linux system.

but you are giving... windows paths...

Take a look here...

Problem with filebeat yml file on Windows

Have a look at our YAML tips and gotchas. The problem is with the backslash character in the different paths: path: C:\Users\.... <--- Wrong Here, the YAML parser undestands \U as the start of a UNICODE escape character. As the documentation suggests, you should wrap paths in 'single quotes': path: 'C:\Users....' <---- Correct

@dfir

["/D:/01-evidence/122/logs*"]

Definitely not correct ^^^

see here

Avoid YAML formatting problems | Filebeat Reference [8.15] | Elastic