i am getting error on executing below filebeat yml. if i remove last three lines on json, everything looks ok. But as per the elastic document those three lines are the latest one in case i am reading json log. Then what i am doing wrong in here?
#=========================== Filebeat inputs =============================
filebeat.inputs:
Each - is an input. Most options can be set at the input level, so
you can use different inputs for various configurations.
Below are the input specific configurations.
-
type: log
Change to true to enable this input configuration.
enabled: true
Paths that should be crawled and fetched. Glob based paths.
paths:
#- /var/log/*.log- C:\TR\d\Professional\ELK\Data\sample.log
json.keys_under_root: true
json.add_error_key: true
json.message_key: log