Issue with Json?

[killmasta93]

Hi,
I was wondering if someone could shed some light on the issue im having. Currently have Elastic Search 6. Im currently trying to send .json files to the Elastic search via logstash. the issue im having on the filebeat.yml i have configured this

- type: log

  # Change to true to enable this input configuration.
   enabled: true

   # Paths that should be crawled and fetched. Glob based paths.
   paths:
    - /var/log/jsonlogs/*.json
     json.keys_under_root: true
  json.add_error_key: true
   json.message_key: log

but when i restart filebeat i keep getting

filebeat[12237]: Exiting: error loading config file: yaml: line 29: mapping values are not allowed in this context

any ideas?

[Christian_Dahlqvist]

It is difficult to tell what line 29 is, but it looks like you may have incorrect indentation, which could cause problems as yaml is indentation sensitive.

[steffens (Steffen Siering)]

YAML (file format used by filebeat) is sensitive to indentation. You can use yamllint.com to check your complete file. Just having a snippet from your config + a line number in you full config file makes it really hard to tell where you have the syntax error. Btw. json.add_error_key: true seems to be missing a space . Also allign comments with settings. All indentation looks a little off and there might be other issues in your file => yamllint.com

[killmasta93]

@Christian_Dahlqvist and @steffens Thanks for the replies, your both correct. If anyone else has the same issue its because the : true has to be together and no spaces.

   - /var/log/jsonlogs/*.json
      json.keys_under_root:true
    json.add_error_key:true
       json.message_key:log

then it works i also wanted to say the http://yamllint.com is extremely useful.

Thank you again