diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 6794df1f8e6e..dda00b993bee 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -187,6 +187,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix s3 input when there is a blank line in the log file. {pull}25357[25357]
 - Fixes the Snyk module to work with the new API changes. {pull}27358[27358]
 - Fixes a bug in `http_endpoint` that caused numbers encoded as strings. {issue}27382[27382] {pull}27480[27480]
+- Update indentation for azure filebeat configuration. {pull}26604[26604]
 
 *Heartbeat*
 
diff --git a/filebeat/docs/modules/azure.asciidoc b/filebeat/docs/modules/azure.asciidoc
index 78685b96475e..ca1662a60715 100644
--- a/filebeat/docs/modules/azure.asciidoc
+++ b/filebeat/docs/modules/azure.asciidoc
@@ -47,35 +47,35 @@ Will retrieve azure Active Directory audit logs. The audit logs provide traceabi
       storage_account_key: ""
       resource_manager_endpoint: ""
 
-   platformlogs:
-     enabled: false
-     var:
-       eventhub: ""
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
-
-   auditlogs:
-     enabled: false
-     var:
-       eventhub: "insights-logs-auditlogs"
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
-
-   signinlogs:
-     enabled: false
-     var:
-       eventhub: "insights-logs-signinlogs"
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
+  platformlogs:
+    enabled: false
+    var:
+      eventhub: ""
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
+
+  auditlogs:
+    enabled: false
+    var:
+      eventhub: "insights-logs-auditlogs"
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
+
+  signinlogs:
+    enabled: false
+    var:
+      eventhub: "insights-logs-signinlogs"
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
 
 ----
 
diff --git a/x-pack/filebeat/module/azure/_meta/docs.asciidoc b/x-pack/filebeat/module/azure/_meta/docs.asciidoc
index e295c981e57b..a1f3501c7c7d 100644
--- a/x-pack/filebeat/module/azure/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/azure/_meta/docs.asciidoc
@@ -42,35 +42,35 @@ Will retrieve azure Active Directory audit logs. The audit logs provide traceabi
       storage_account_key: ""
       resource_manager_endpoint: ""
 
-   platformlogs:
-     enabled: false
-     var:
-       eventhub: ""
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
-
-   auditlogs:
-     enabled: false
-     var:
-       eventhub: "insights-logs-auditlogs"
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
-
-   signinlogs:
-     enabled: false
-     var:
-       eventhub: "insights-logs-signinlogs"
-       consumer_group: "$Default"
-       connection_string: ""
-       storage_account: ""
-       storage_account_key: ""
-       resource_manager_endpoint: ""
+  platformlogs:
+    enabled: false
+    var:
+      eventhub: ""
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
+
+  auditlogs:
+    enabled: false
+    var:
+      eventhub: "insights-logs-auditlogs"
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
+
+  signinlogs:
+    enabled: false
+    var:
+      eventhub: "insights-logs-signinlogs"
+      consumer_group: "$Default"
+      connection_string: ""
+      storage_account: ""
+      storage_account_key: ""
+      resource_manager_endpoint: ""
 
 ----