# Beats not parsed **URL:** \ **Category:** Logstash\ **Created:** [January 5, 2020, 5:30pm UTC](https://discuss.elastic.co/t/beats-not-parsed/213815 "2020-01-05T17:30:37Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![omrip](https://avatars.discourse-cdn.com/v4/letter/o/a9adbd/32.png) [@omrip](https://discuss.elastic.co/u/omrip)\ **Post date:** [January 5, 2020, 5:30pm UTC](https://discuss.elastic.co/t/beats-not-parsed/213815/1 "2020-01-05T17:30:37Z")
when using beats as input the data show constantly to the console and seems all scrambled, what can be the reason? input { beats { port =\> 5044 } } filter { if "beats\_input\_codec\_plain\_applied" in [tags] { mutate { remove\_tag =\> ["beats\_input\_codec\_plain\_applied"] } } } output { azure\_loganalytics { customer\_id =\> "xxxxxx" shared\_key =\> "xxxxxx" log\_type =\> "Syslog" time\_generated\_field =\> "iso8610timestamp" key\_names =\> ['cloud','message','winlog','instance','agent','host','tags'] key\_types =\> {'cloud'=\>'string' 'message'=\>'string' 'winlog'=\>'string' 'instance'=\>'string' 'tags'=\>'string' agent=\>'string' host=\>'string'} flush\_items =\> 10 flush\_interval\_time =\> 5 } if "machine1" in [tags] { azure\_loganalytics { customer\_id =\> "xxxxxx" shared\_key =\> "xxxxxx" log\_type =\> "Syslog" time\_generated\_field =\> "iso8610timestamp" key\_names =\> ['cloud','message','winlog','instance','agent','host','tags'] key\_types =\> {'cloud'=\>'string' 'message'=\>'string' 'winlog'=\>'string' 'instance'=\>'string' 'tags'=\>'string' agent=\>'string' host=\>'string'} flush\_items =\> 10 flush\_interval\_time =\> 5 } } else if "Machine2" in [tags]{ azure\_loganalytics { customer\_id =\> "xxxxxx" shared\_key =\> "xxxxxx" log\_type =\> "Syslog" time\_generated\_field =\> "iso8610timestamp" key\_names =\> ['cloud','message','instance','winlog','agent','host','tags'] key\_types =\> {'cloud'=\>'string' 'message'=\>'string' 'winlog'=\>'string' 'instance'=\>'string' 'tags'=\>'string' agent=\>'string' host=\>'string'} flush\_items =\> 10 flush\_interval\_time =\> 5 } } else { azure\_loganalytics { customer\_id =\> "xxxxxx" shared\_key =\> "xxxxxx" log\_type =\> "Syslog" time\_generated\_field =\> "iso8610timestamp" key\_names =\> ['cloud','message','instance','winlog','agent','host','tags'] key\_types =\> {'cloud'=\>'string' 'message'=\>'string' 'winlog'=\>'string' 'instance'=\>'string' 'tags'=\>'string' agent=\>'string' host=\>'string'} flush\_items =\> 10 flush\_interval\_time =\> 5 } } } example log file: "instance":{"name":"Opwindows-machine","id":"5xxxxxxx"},"region":"westeurope","machine":{"type":"Standard\_D2\_v2"},"provider":"az"},"message":"The handle to an object was closed.\n\nSubjec t :\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tDomain-WIN10-VM$\n\tAccount Domain:\t\tDomain\n\tLogon ID:\t\t0x3E7\n\nObject:\n\tObject Server:\t\tSecurity\n\tHandle ID:\t\t0x1d2c\n\nProc ess Information:\n\tProcess ID:\t\t0x214\n\tProcess Name:\t\tC:\WindowsAzure\GuestAgent\_2.7.41491.949\_2019-12-11\_215454\CollectGuestLogs.exe","winlog":{"keywords":["Audit Success"],"compu ter\_name":"Domain-Win10-VM.Domain.local","opcode":"Info","api":"wineventlog","event\_id":4658,"process":{"pid":4,"thread":{"id":2672}},"channel":"Security","task":"File System","provider\_guid": "{xxxxxxxx}","record\_id":421390702,"event\_data":{"SubjectDomainName":"Domain","ProcessId":"0x214","ProcessName":"C:\WindowsAzure\GuestAgent\_2.7.41491.949\_2019-12 -11\_215454\CollectGuestLogs.exe","HandleId":"0x1d2c","ObjectServer":"Security","SubjectUserName":"Domain-WIN10-VM$","SubjectLogonId":"0x3e7","SubjectUserSid":"S-1-5-18"},"provider\_name":"Mic rosoft-Windows-Security-Auditing"},"agent":{"hostname":"Domain-Win10-VM","id":"1f9a2496-2410-48bd-beba-927f4e21139c","type":"winlogbeat","version":"7.5.0","ephemeral\_id":"06dc3765-4886-4af5-b 47b-8652742d0d9f"},"host":{"architecture":"x86\_64","hostname":"Domain-Win10-VM","name":"Domain-Win10-VM","os":{"kernel":"10.0.18362.535 (WinBuild.160101.0800)","family":"windows","platform":"w indows","name":"Windows 10 Pro","version":"10.0","build":"18362.535"},"id":"xxxxxxx"},"tags":},{"cloud":{"instance":{"name":"Domain-Domain-02","id":"ad1e311f-9f0 f-438f-b9fc-2463bd849185"},"region":"westeurope","machine":{"type":"Standard\_DS2\_v2"},"provider":"az"},"message":"A handle to an object was requested.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18 \n\tAccount Name:\t\tDomain-Domain-02$\n\tAccount Domain:\t\tDomain\n\tLogon ID:\t\t0x3E7\n\nObject:\n\tObject Server:\t\tSecurity\n\tObject Type:\t\tKey\n\tObject Name:\t\t\REGISTRY\USER\.D EFAULT\n\tHandle ID:\t\t0x714\n\tResource Attributes:\t-\n\nProcess Information:\n\tProcess ID:\t\t0x11dc\n\tProcess Name:\t\tC:\Windows\System32\wbem\WmiPrvSE.exe\n\nAccess Request Info rmation:\n\tTransaction ID:\t\t{00000000-0000-0000-0000-000000000000}\n\tAccesses:\t\tDELETE\n\t\t\t\tREAD\_CONTROL\n\t\t\t\tWRITE\_DAC\n\t\t\t\tWRITE\_OWNER\n\t\t\t\tQuery key value\n\t\t\t\tS et key value\n\t\t\t\tCreate sub-key\n\t\t\t\tEnumerate sub-keys\n\t\t\t\tNotify about changes to keys\n\t\t\t\tCreate Link\n\t\t\t\t\n\tAccess Reasons:\t\t-\n\tAccess Mask:\t\t0xF003F\n\tPr ivileges Used for Access Check:\t-\n\tRestricted SID Count:\t0","winlog":{"keywords":["Audit Success"],"computer\_name":"Domain-Domain-02.Domain.local","opcode":"Info","api":"wineventlog","proce ss":{"pid":4,"thread":{"id":3308}},"event\_id":4656,"task":"Registry","channel":"Security","provider\_guid":"{xxxxxxxx}","record\_id":xxxxxxxx,"version":1,"event\_da ta":{"AccessList":"%%1537\n\t\t\t\t%%1538\n\t\t\t\t%%1539\n\t\t\t\t%%1540\n\t\t\t\t%%4432\n\t\t\t\t%%4433\n\t\t\t\t%%4434\n\t\t\t\t%%4435\n\t\t\t\t%%4436\n\t\t\t\t%%4437\n\t\t\t\t","AccessRe ason":"-","ResourceAttributes":"-","ObjectServer":"Security","HandleId":"0x714","ObjectType":"Key","RestrictedSidCount":"0","SubjectUserSid":"S-1-5-18","TransactionId":"{00000000-0000-0000-0 000-000000000000}","PrivilegeList":"-","SubjectDomainName":"Domain","ProcessId":"0x11dc","ProcessName":"C:\Windows\System32\wbem\WmiPrvSE.exe","SubjectUserName":"Domain-Domain-02$","AccessM ask":"0xf003f","ObjectName":"\REGISTRY\USER\.DEFAULT","SubjectLogonId":"0x3e7"},"provider\_name":"Microsoft-Windows-Security-Auditing"},"agent":{"hostname":"Domain-Domain-02","id":"f45cd3dd- 3afb-4d6d-9ed8-b82074876719","type":"winlogbeat","version":"7.5.0","ephemeral\_id":"42ec19ba-6d1c-4dad-ba2b-d334107ef836"},"host":{"architecture":"x86\_64","name":"Domain-Domain-02","hostname":" Domain-Domain-02","os":{"kernel":"10.0.14393.3383 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 2, 2020, 5:30pm UTC](https://discuss.elastic.co/t/beats-not-parsed/213815/2 "2020-02-02T17:30:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.