winlogbeat.yml config file contains invalid tab characters, as a result ACC Log Analytics - Windows OS Event Logs are not streamed to the instance - Known Error

winlogbeat.yml config file contains invalid tab characters, as a result ACC Log Analytics - Windows OS Event Logs are not streamed to the instance Description After configuring ACC Log Analytics following the documentation at https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/agent-client-collector/concept/accl-setup.html

And enabling the ACC policy "Windows OS Event Logs" to start consuming the event logs, the winlogbeat folder was created under c:\ProgramData\ServiceNow\agent-client-collector\cache\ on the agent machines. However, no data was visible in the Log Viewer screen

After investigation it was identified that the winlogbeat.yml file contains additional TAB characters in front of some of the lines (for example, "ignore_older"). Once they were removed and the config file save the logs started to flow.

Steps to Reproduce

Enable the ACC policy "Windows OS Event Logs" Notice that winlogbeat.yml will be created with tab characters present in some lines. Logs will only flow once these tabbed characters are removed.

Workaround Workaround is to open winlogbeat.yml.txt in nodepad+++ or any text editor that can see special characters, remove the TAB characters, then restart ACC service. You may try below powershell script to remove the TAP characters. If below works for you, then you may deploy it to other computers using tools like AD group policy (get-content "C:\ProgramData\ServiceNow\agent-client-collector\cache\winlogbeat.yml.txt") -replace "`t","" | set-content "C:\ProgramData\ServiceNow\agent-client-collector\cache\winlogbeat.yml.txt" Related Problem: PRB1755676