# Bug with filebeat inlucde\_lines?

**URL:** <https://discuss.elastic.co/t/bug-with-filebeat-inlucde-lines/214138>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 7, 2020, 10:05pm UTC](https://discuss.elastic.co/t/bug-with-filebeat-inlucde-lines/214138 "2020-01-07T22:05:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RunningSmurf](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)\
**Post date:** [January 7, 2020, 10:05pm UTC](https://discuss.elastic.co/t/bug-with-filebeat-inlucde-lines/214138/1 "2020-01-07T22:05:34Z")

</div>

Hello,

I have been trying to use the include\_lines option in the filebeat.yml file to read a SQL Server log file. Note that I am not using the mssql module of FileBeat; I just have an input of type log and point it to my SQL Server log. I cannot get the inlude\_lines to work, after trying multiple variations and doing some extensive online research.

I create a dummy log file and update the lines manually. I point my filebeat to that dummy log. The include\_lines option works perfectly fine.

Has anyone run into this issue?

In the mssql.yml file, I do not see an option to use include\_lines, and the documentation does not mention it. Would anyone have a proven methodology for filtering SQL Server lines from logs? Thanks!

Sincerely,

RS

---

<div class="post-metadata">

**Author:** ![RunningSmurf](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)\
**Post date:** [January 7, 2020, 10:13pm UTC](https://discuss.elastic.co/t/bug-with-filebeat-inlucde-lines/214138/2 "2020-01-07T22:13:45Z")

</div>

Note: when I use the include\_lines to include lines that have the word "dummy" in filebeat.yml, and point it to a SQL Server log, I get the following messages when running in debug mode - I also include below a screenshot of filebeat.yml. Thanks!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1bb1206ecae6fc46f9992850aab99cbf735ac206.png)

Notice the spaces in the result from the debug mode:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b7341eb3e310638d3cd935e69a4c9f019d3d774c.png)

The log file clearly shows that the string 'dummy' is in the line items. So why would inlude\_lines not see 'dummy'? Like I mentioned, in my test log file, where I enter the values manually, no issues.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18a71f24740d199a01a3a9981c145991a8b18968.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2020, 10:13pm UTC](https://discuss.elastic.co/t/bug-with-filebeat-inlucde-lines/214138/3 "2020-02-04T22:13:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.