title: Parse error in aggregation
logsource:
    product: linux
detection:
    foo: 
        - test
    condition: foo | foo bar