Unable to start Filebeat due to YAML config issue

[ohk (Omar Hayak)]

Hi
I have this Filebeat configuration :

- input_type: log
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /home/ohk/data/nginx.log
  document_type: nginx #line 22
  multiline.pattern: ["^(\b(?:\d{1,3}\.){3}\d{1,3}\b)"]
  multiline.negate: false
  multiline.match: after
  #############################################################
  paths:
    - /home/ohk/data/api.log
  document_type: api
  multiline.pattern: ["^(INFO in )"]
  multiline.negate: false
  multiline.match: after

when I try to start my filebeat service I get this error:

Exiting: error loading config file: yaml: line 22: found unknown escape character
I marked line 22 in the example above, and I checked that all indents are spaces only. Do you have any idea about this unknown escape character ?

Thank you in advance,

[steffens (Steffen Siering)]

Uhm... do you count lines from 0 or 1... TBH I'm not sure if the yaml parser counts from 0 or 1

My initial guess it's due to quoting the regex with " . When you use ", the yaml parser interprets the strings content , treating \b, \d and such as escape characters. Using single quotes ' (as recommended in our docs) to not have the yaml parser interpret the regular expression.

[ohk (Omar Hayak)]

Thank you, you're right I used go-to-line from nano so I was one line above the real problem.