trying to accomplish:
my prospector looks similar to this:
- type: log enabled: true paths: - /var/log/auth.log tags: auth exclude_files: ['\.gz$'] fields_under_root: true
However i'm getting this when trying to start up filebeat:
2018-06-22T18:20:34.797Z WARN fmtstr/formatevents.go:398 Can not convert key '[auth]' value to string
On filebeat 6.2.2
Any thoughts? I'm truly stuck.