# Do you know how to solve this in logs? **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting\ **Created:** [March 5, 2021, 6:31am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321 "2021-03-05T06:31:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![b4yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b4yu/32/85020_2.png) [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Post date:** [March 5, 2021, 6:31am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/1 "2021-03-05T06:31:58Z")
i got this on kibana logs how to fix it so kibana logs can work? failed to format message from /var/log/suricata/eve.json ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [March 5, 2021, 12:58pm UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/2 "2021-03-05T12:58:37Z")
Can you post the whole error message? this is very vague right now. ---
**Author:** ![b4yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b4yu/32/85020_2.png) [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Post date:** [March 5, 2021, 1:37pm UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/3 "2021-03-05T13:37:21Z")
![logs](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbf5fde78278be3f37ba2221cfc598f2357b7ded.png) ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [March 5, 2021, 1:41pm UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/4 "2021-03-05T13:41:09Z")
That looks part of the Logs UI. I guess you're ingesting logs from suricata with Filebeat. It looks like a Filebeat processing error. You need to check what processor it's using and figure the errors out from there. There should be more info in the Filebeat error logs. ---
**Author:** ![b4yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b4yu/32/85020_2.png) [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Post date:** [March 5, 2021, 2:51pm UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/5 "2021-03-05T14:51:14Z")
i am using suricata module on filebeat module filebeat modules enable suricata ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [March 5, 2021, 3:05pm UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/6 "2021-03-05T15:05:36Z")
What is in the Filebeat logs? You have to start there. This is not a kibana issue, kibana only displays data and that's the data Filebeat ingests when there's an error. Make sure the configurations are ok and that the suricata logs are in the default place (otherwise you can specify another on in the filebeat configs). > **[Suricata module | Filebeat Reference \[7.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-suricata.html)** ---
**Author:** ![b4yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b4yu/32/85020_2.png) [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Post date:** [March 6, 2021, 9:47am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/7 "2021-03-06T09:47:21Z")
when not enabling suricata, it looks like this ![log](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbecc6d409b912ffa66dc29626580cbb03a34791.png) but when activating suricata, it's like this again ![logs](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbf5fde78278be3f37ba2221cfc598f2357b7ded.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 3, 2021, 9:48am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321/8 "2021-04-03T09:48:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.