Processors

README.md

@@ -158,7 +158,7 @@ class{"filebeat":
   processors => [
     {
       "name" => "drop_fields",
-      "params" => ["input_type", "offset"]
+      "params" => {"fields" => ["input_type", "offset"]}
     },
   ],
 }
@@ -184,7 +184,7 @@ class{"filebeat":
   processors => [
     {
       "name" => "drop_fields",
-      "params" => ["input_type", "offset"]
+      "params" => {"fields" => ["input_type", "offset"]}
     },
     {
       "name" => "drop_event",
@@ -328,6 +328,9 @@ to fully understand what these parameters do.
 This module doesn't load the [elasticsearch index template](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html#filebeat-template) into elasticsearch (required when shipping
 directly to elasticsearch).
 
+Only filebeat versions after 1.0.0-rc1 are supported. 1.0.0-rc1 and older don't
+support YAML like the ruby template can easily generate.
+
 When installing on Windows, there's an expectation that `C:\Temp` already exists, or an alternative
 location specified in the `tmp_dir` parameter exists and is writable by puppet. The temp directory
 is used to store the downloaded installer only.

templates/filebeat5.yml.erb

@@ -1,11 +1,11 @@
 <%-
-  def yaml_indent(conds, idx=4)
+  def yaml_indent(conds)
     return_val = []
     tmp_val = conds.to_yaml.split("\n")
     tmp_val.delete('---')
 
     tmp_val.each do |val|
-      return_val << "    " + val
+      return_val << "        " + val
     end
 
     return_val.join("\n")
@@ -79,13 +79,13 @@ max_procs: <%= @filebeat_config['max_procs'] %>
 <%- unless @filebeat_config['processors'].empty? -%>
 processors:
   <%- @filebeat_config['processors'].each do |_proc| -%>
-- <%= _proc['name'] %>:
+  - <%= _proc['name'] %>:
     <%- unless _proc['when'].nil? or _proc['when'].empty? -%>
-  when:
+      when:
 <%=  yaml_indent(_proc['when']) %>
     <%- end -%>
     <%- _proc['params'].each do |key,val|-%>
-  <%= key %>: <%= val %>
+      <%= key %>: <%= val %>
     <%- end -%>
   <%- end -%>
 <%- end -%>