Multiple options "Decode_Field_as" in Parser in YAML has invalid format

[heejew]

Bug Report

I have a "classic mode" configuration a parser with these two lines:

Decode_Field_as escaped message try_next
Decode_Field_as json message 

and I had a problem with converting this to YAML:
I tried to do this

      decode_field_as: 
      - type: escaped
        field: message
        action: try_next
      - type: json
        field: message

and that

decode_field_as:
  - escaped message try_next
  - json message 

also,

      rules: 
      - backend: decode_field_as
        type: escaped
        field: message
        action: try_next
      - backend: decode_field_as
        type: json
        field: message

BUT, it turns out, working config in YAML look like as

decode_field_as: escaped message try_next 
decode_field_as: json message 

And this is incorrect formating in YAML and i can't use autogeneration YAML, every tools when parsing lose one of the parameters.
Please, make it more correct everywhere.

• Version used: 3.2.2

[allewell]

I've noticed the same for rewrite_tag rule:

  filters:
    - name: rewrite_tag
      match: applog_temp
      rule: '$log  "java\.lang\.StackOverflowError"  critical_events  false'
      rule: '$log  "\[c\.a\.jira\.startup\.JiraStartupLogger\] Running Jira startup checks"  critical_events  false'

and parser parser

   - name: parser
      match: critical_events
      key_name: log
      reserve_data: true
      parser: stackoverflowerror
      parser: jira_start

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.