Filebeat test config failing

i am getting error on executing below filebeat yml. if i remove last three lines on json, everything looks ok. But as per the elastic document those three lines are the latest one in case i am reading json log. Then what i am doing wrong in here?

#=========================== Filebeat inputs =============================


Each - is an input. Most options can be set at the input level, so

you can use different inputs for various configurations.

Below are the input specific configurations.

  • type: log

    Change to true to enable this input configuration.

    enabled: true

    Paths that should be crawled and fetched. Glob based paths.

    #- /var/log/*.log

    • C:\TR\d\Professional\ELK\Data\sample.log

    json.keys_under_root: true
    json.add_error_key: true
    json.message_key: log

Looks like space is the issue in here. I removed one space from all those three lines and things looks ok.config test is working fine now.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.