# Exclude binary data filebeat in logfile

**URL:** <https://discuss.elastic.co/t/exclude-binary-data-filebeat-in-logfile/291031>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 6, 2021, 11:33am UTC](https://discuss.elastic.co/t/exclude-binary-data-filebeat-in-logfile/291031 "2021-12-06T11:33:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Post date:** [December 6, 2021, 11:33am UTC](https://discuss.elastic.co/t/exclude-binary-data-filebeat-in-logfile/291031/1 "2021-12-06T11:33:22Z")

</div>

Hi,

I've got a multiline log file that has following structure

```auto
2021-12-06 11:36:31,088 ....
2021-12-06 11:36:32,588 ...
2021-12-06 11:36:34,127 ---------------------------
ID: 82506
Response-Code: 200
Content-Type: application/pdf
Headers: {Content-Type=[application/pdf], Date=[Mon, 06 Dec 2021 10:36:34 GMT]}
Payload: %PDF-1.5
%����
2 0 obj<</Filter/FlateDecode/Length 16681>>stream
x^A��Ms^]Ǖ���^Uw5*D^Xнu?�w�,��A۲͎�^Y�^W^P^HʰI�^F@�{~�,z1���^C�yޓY^W$^E�&bb�^Q^DNfV~��<�U�ۓ�x�ݏ���xqﺡ��qu��]�W��O���Ŵ�v�^X��j3�^W�#M6�ŭ�z���O~���/�m�z�� ��V��z��1ȳ�_^O���_��_�ߜm7^W���wg���~X=�^=?ۮ/�û7g���8��~��Ң�p���Wgljv����ٯ�|������!���w���ϸO��׻���Wo�v�������-+^Y��V/o���ݭ�nΟ����p}w��9^Nw+��^�������ՕS>���ͻ�qO���^^�����4�q�,^S^_���O��~�=��^M�]��3Y>�_�Iܞ�7L�"^K���� ?^]�~ry���4^]^G����?;�40iXv^X�o�n
2021-12-06 11:37:34,127 ...
2021-12-06 11:37:34,127 ...

```

Config:

```auto
-
      type: log
      fields_under_root: true
      
      paths:
        - /mydirtylogfile
      multiline:
        pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
        negate: true
        match: after

```

This works perfectly.

However there is a problem that in the lines that do not start with a date there is the possibility that it dumps binary lines (see example). In the past this went trough (using filebeat -\> logstash -\> elastic)

I think the frequency that this occurs has risen. Now I see that after a while no log lines are being processed. Lines are indexes 2 hours later then what was in the logline. (timestamp logline vs @timestamp logstash). So it looks like filebeat is having issues.

Is there a way to exclude "binairy lines" form being processed by filebeat. I've talk to develepment to see if the can simply not log the data but that is "impossible"

Anyone got any pointers for this?

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [December 7, 2021, 4:43pm UTC](https://discuss.elastic.co/t/exclude-binary-data-filebeat-in-logfile/291031/2 "2021-12-07T16:43:51Z")

</div>

Have you tried to use processors? [Filter and enhance data with processors | Filebeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2022, 6:44pm UTC](https://discuss.elastic.co/t/exclude-binary-data-filebeat-in-logfile/291031/3 "2022-01-04T18:44:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.