Issue with the indices field of elasticsearch output


I'm trying to send my logs to multiple indices based on a field value.
In the documentation, it says that I can do this by using the "indices" field in the elasticsearch output :

To tests this, I add to my filebeat.yml :
- index: "critical-%{+yyyy.MM.dd}"
message: "CRITICAL"
- index: "error-%{+yyyy.MM.dd}"
message: "ERR"

Now I restart filebeat and it fails with this error :
Exiting: error loading config file: yaml: line 313: found character that cannot start any token

Line 313 is the line where I add the "indices" field.
I don't find what error I did. I just copy/paste the exemple from the documentation.

Can someone help me with this ?

(Steffen Siering) #2

the YAML parser is failing on your configuration. YAML is sensitive to indentation. The config file by default uses 2 spaces per level.

You can test your yaml with .

Please format configs using the </>-button. Having a syntax error in your config, we will need to see the complete config.


Thanks, that was that. An indentation error.
Now it works.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.