Graylog 3.0 filebeat configuration and tags

[flosto (Florian)]

@benvanstaveren

To make it easier, you can create “variables” that contain snippets of configuration that can be re-used between configurations

@benvanstaveren I would like to try this approach but am struggling with multiline strings in variables:
Say I have a multiline snippet/variable:

multiline:
  match: after
  negate: true
  pattern: ^20[0-3][0-9]\.

that I want to include in my filebeat config like that:

fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

filebeat.inputs:
- input_type: log
  paths:
    - /var/log/*.log
  type: log
  ${user.multiline}
output.logstash:
   hosts: ["192.168.1.1:5044"]
path:
  data: /var/lib/graylog-sidecar/collectors/filebeat/data
  logs: /var/lib/graylog-sidecar/collectors/filebeat/log

Then the preview shows:

fields_under_root: true
fields.collector_node_id: <node name>
fields.gl2_source_collector: <node id>

filebeat.inputs:
- input_type: log
  paths:
    - /var/log/*.log
  type: log
  multiline:
  match: after
  negate: true
  pattern: ^20[0-3][0-9]\.
output.logstash:
   hosts: ["192.168.1.1:5044"]
path:
  data: /var/lib/graylog-sidecar/collectors/filebeat/data
  logs: /var/lib/graylog-sidecar/collectors/filebeat/log

So it screws up the indentation. Any idea how I can get multiline variables to always have the same indentation? Or did I misinterpret the snippets idea entirely?