Cameron

Elasticsearch query malformed when rule.yaml uses 2 space indentation

1

When rule files are indented with 2 spaces (the yaml suggested indentation), queries become malformed with the error message: ``` WARNING:elasticsearch:GET http://elasticsearch:9200/logstash*/_search?_source_include=%40timestamp%2C%2A&ignore_unavailable=true&scroll=30s&size=10000 [status:400 request:0.156s] ERROR:root:Error running query: RequestError(400, u'parsing_exception', u'[query_string]...