WARNING: Version 5.0 of Winlogbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
YAML Tips and Gotchas
editYAML Tips and Gotchas
editThe Winlogbeat configuration file uses YAML for its syntax. When you edit the file to modify configuration settings, there are a few things that you should know.
Use Spaces for Indentation
editIndentation is meaningful in YAML. Make sure that you use spaces, rather than tab characters, to indent sections.
Look at the Default Config File for Structure
editThe best way to understand where to define a configuration option is by looking at the winlogbeat.yml configuration file. The configuration file contains most of the configuration options that are available for Winlogbeat. To change a configuration setting, simply uncomment the line and change the setting.
Test Your Config File
editYou can test your configuration file to verify that the structure is valid.
Simply change to the directory where the binary is installed, and run
Winlogbeat in the foreground with the -configtest flag specified. For example:
.\winlogbeat.exe -c .\winlogbeat.yml -configtest -e
You’ll see a message if Winlogbeat finds an error in the file.
Wrap Regular Expressions in Single Quotation Marks
editIf you need to specify a regular expression in a YAML file, it’s a good idea to wrap the regular expression in single quotation marks to work around YAML’s tricky rules for string escaping.
For more information about YAML, see http://yaml.org/.