# FIlebeat Output Configuration Error

**URL:** <https://discuss.elastic.co/t/filebeat-output-configuration-error/366175>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 6, 2024, 10:33pm UTC](https://discuss.elastic.co/t/filebeat-output-configuration-error/366175 "2024-09-06T22:33:19Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 9, 2024, 5:36pm UTC](https://discuss.elastic.co/t/filebeat-output-configuration-error/366175/13 "2024-09-09T17:36:56Z")

</div>

I am confused you are saying linux logs

> [@dfir](#):
>
> I am trying to ingest standard auth.log(s) and syslogs from a linux system.

but you are giving... windows paths...

Take a look here...

> [@Problem with filebeat yml file on Windows](https://discuss.elastic.co/t/problem-with-filebeat-yml-file-on-windows/167154/2):
>
> Have a look at our [YAML tips and gotchas.](https://www.elastic.co/guide/en/beats/filebeat/6.6/yaml-tips.html) The problem is with the backslash character in the different paths: path: C:\Users\.... \<--- Wrong Here, the YAML parser undestands \U as the start of a UNICODE escape character. As the documentation suggests, you should wrap paths in 'single quotes': path: 'C:\Users....' \<---- Correct

> [@dfir](#):
>
> ` ["/D:/01-evidence/122/logs*"]`

Definitely not correct ^^^

see here

> **[Avoid YAML formatting problems | Filebeat Reference \[8.15\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.15/yaml-tips.html#wrap-paths-in-quotes)**

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-output-configuration-error/366175)._