expected a string for key Windows OS

[umpa385]

Hello, this might be me just not understanding what is going on, but I'm getting this error log below. I'm just trying to see how the evtx logs would look locally on the host before moving on with pushing it to an aggregator.

ERROR vector::cli: Configuration error. error=invalid type: sequence, expected a string for key sinks.vector_windows

Config file is here

#gets powershell logs
[sources.vector_windows]
type = "file"
include = ["C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx"]
read_from = "beginning"

#prints out the powershell logs to the path below
[sinks.vector_windows]
type = "file"
inputs =["vector_windows"]
compression= "none"
path = ["C:\Users\Administrator\Documents\vector.log"]

[jszwedko]

Hi @umpa385 ! The error could definitely be improved here, but it is because the path for the file sink should be a single string rather than a list as you have here. Try setting path = "C:\Users\Administrator\Documents\vector.log".

[umpa385]

[sources.vector_windows]
type = "file"
include = ["C:\Windows\System32\LogFiles\Firewall\pfirewall.log"]
read_from = "beginning"

[sinks.inputs]
type = "file"
inputs = ["vector_windows"]
path = "C:\Users\Administrator\Documents\vector.log"
#[sinks.out.encoding]
#codec = "json"

I think the issue is that it doesn't like the "sinks.inputs" for whatever reason. I am also doing this on a windows machine hence the "\" for the path

failure log below.

2022-06-16T19:49:19.604196Z INFO vector::app: Log level is enabled. level="vector=info,codec=info,vrl=info,file_source=info,tower_limit=trace,rdkafka=info,buffers=info,kube=info"
2022-06-16T19:49:19.604909Z INFO vector::app: Loading configs. paths=["config\test.toml"]
2022-06-16T19:49:19.607068Z ERROR vector::cli: Configuration error. error=missing field encoding for key sinks.inputs

[spencergilbert]

https://vector.dev/docs/reference/configuration/sinks/file/#encoding is a required field - so you should uncomment it (also you've misnamed your subsection sinks.out should be sinks.inputs based on what you named things.

[umpa385]

Thank you I think that fixed the issue with both of those changes, got another error for data_dir, but I think I need to call that out explicitly because I believe the current msi doesn't update the default directory for windows.