When you run setup on auditbeat (and perhaps others), it tells you that if you want to overwrite the ILM policy, you need to add a configuration option. The problem is that the message does not include a space after the colon, which is invalid YAML

$ sudo auditbeat setup
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.

If a user follows this instruction, it leads to an error:

$ tail -1 /etc/auditbeat/auditbeat.yml
setup.ilm.overwrite:true
$ sudo auditbeat setup
Exiting: error loading config file: yaml: line 218: could not find expected ':'

I don't consider this a bug, per se, but a need for an improved message. Not sure which tag to add for that.