title: filebeat.yml.rpmnew or filebeat.yml
body: <p>I installed recently filebeat, and I would like to edit the yml file to specify this input: </p>
  
  <pre><code>filebeat.prospectors:
  - input_type: log
  paths:
  - /path/*.xml
  # scan_frequency: 60s
  document_type: message
  multiline.pattern: '^&lt;measInfo'
  multiline.negate: true
  multiline.match: after
  </code></pre>
  
  <p>I should edit the file filebeat.yml or filebeat.yml.rpmnew? </p>
  
  <p>When I edit filebeat.yml I get this message error : </p>
  
  <pre><code>filebeat.service - filebeat
  Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
  Active: failed (Result: start-limit) since Thu 2018-07-19 11:35:40 CEST; 2s ago
  Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 4695 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
  Main PID: 4695 (code=exited, status=1/FAILURE)
  </code></pre>