# Filebeat breaks log entries when there is a colon in the value of a field

**URL:** <https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 26, 2024, 9:07am UTC](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079 "2024-06-26T09:07:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kkovacs](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@kkovacs](https://discuss.elastic.co/u/kkovacs)\
**Post date:** [June 26, 2024, 9:07am UTC](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079/1 "2024-06-26T09:07:05Z")

</div>

Dear Community,

I would like to ask for an advice from you. I tried several methods to resolve this problem, but without a success.

My problem is: If a log entry (generated by my application) contains a colon (":"), filebeat breaks the value of the field (the field that contains the colon) and places it into seperate fields.

My filebeat.yml:

```auto
# ---------------------------- Log files Input ------------------------------
filebeat.inputs:

  - type: log
    enabled: true
    json.keys_under_root: true
    json.add_error_key: true
    fields:
      log_type: log_1
    paths:
      - path/to/log/file

# ---------------------------- Elasticsearch Output --------------------------
output:
  elasticsearch:
    hosts: ...
    index: "%{[fields.log_type]}-%{+yyyy.MM.dd}"

# ---------------------------- Elasticsearch settings ------------------------
setup:
  template:
    name: "filebeat"
    pattern: "*"
    settings:
      index.number_of_shards: 3
      index.number_of_replicas: 1
  ilm:
    enabled: false
# ---------------------------- Processors ------------------------
 processors:
  - convert:
      fields:
        - from: "message"
          to: "message"
          type: "string"

```

Example log entry:

```auto
{"reqId":"t45rtdfg2zd9d74bbd4d6df100befa56","level":3,"time":"2024-06-26T08:44:03.234+00:00","remoteAddr":"xx.xx.xx.xx","user":"user1","app":"no app in context","method":"GET","url":"/index.php/one.jpg","message":"Requested file with invalid file id: -1","userAgent":"Mozilla/5.0 (Android) myApp/9.10.9","version":"9.10.9","data":[]}

```

or the same in a readable format:

```auto
{
"reqId":"t45rtdfg2zd9d74bbd4d6df100befa56",
"level":3,
"time":"2024-06-26T08:44:03.234+00:00",
"remoteAddr":"xx.xx.xx.xx",
"user":"user1",
"app":"no app in context",
"method":"GET",
"url":"/index.php/one.jpg",
"message":"Requested file with invalid file id: -1",
"userAgent":"Mozilla/5.0 (Android) myApp/9.10.9",
"version":"9.10.9",
"data":[]
}

```

The rest of the log entries (that does not contain a colon in the "message" field) are processed fine, and displayed in Kibana as it should.

Is there any method to escape the colons in that field or any other method to solve this problem?

I am using filebeat version 7.12, and Kibana 7.10.2.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [June 26, 2024, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079/2 "2024-06-26T12:26:31Z")

</div>

Hi,

you can try to use the Decode Json Fields

> **[Decode JSON fields | Filebeat Reference \[8.14\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/decode-json-fields.html)**

Regards

---

<div class="post-metadata">

**Author:** ![kkovacs](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@kkovacs](https://discuss.elastic.co/u/kkovacs)\
**Post date:** [June 27, 2024, 7:40am UTC](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079/3 "2024-06-27T07:40:32Z")

</div>

Hi yago82,

Thanks for your answer, however I already tried it without success. This is what I've tried:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /path/to/your/logfile.log
  processors:
    - decode_json_fields:
        fields: ["message"]
        process_array: false
        max_depth: 1
        target: ""
        overwrite_keys: true

```

and tried with dissect as well, but there were no effect:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /path/to/your/logfile.log
  processors:
      - dissect:
          tokenizer: "%{message}"
          field: "message"
          trim_values: "none"
          ignore_failure: true
          overwrite_keys: true
          target_prefix: ""

```