# Filebeat docker help
**URL:** https://discuss.elastic.co/t/filebeat-docker-help/197161
**Category:** Beats
**Created:** [August 28, 2019, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161 "2019-08-28T15:50:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Phil\_Brady](https://discuss.elastic.co/u/Phil_Brady)
#### Post date: [August 28, 2019, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161/1 "2019-08-28T15:50:46Z")
Sorry if these questions have been answered before, I am new to elastic and cannot find the answers
I have an entry in my docker logs that looks like this
> Wed, 28 Aug 2019 15:40:23 GMT - info: Prematch events sync process started
When filebeat ships it elastic it ends up like this
> Wed, 28 Aug 2019 15:40:23 GMT - e[32minfoe[39m: Prematch events sync process started
Firstly can I get rid of the "e[32m" and "e[39m"?
Secondly, I get rid of the timestamp as there is already a field for this?
Thirdly I am seeing these errors. How can I stop them?
> ERROR readjson/json.go:52 Error decoding JSON: invalid character 'a' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: invalid character 'a' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: invalid character 'W' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: invalid character ':' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: json: cannot unmarshal number into Go value of type map[stri
> ERROR readjson/json.go:52 Error decoding JSON: invalid character ':' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: invalid character 'c' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: json: cannot unmarshal number into Go value of type map[stri
> ERROR readjson/json.go:52 Error decoding JSON: invalid character ':' looking for beginning of value
> ERROR readjson/json.go:52 Error decoding JSON: invalid character ':' looking for beginning of value
---
### Author:  [@Phil\_Brady](https://discuss.elastic.co/u/Phil_Brady)
#### Post date: [August 28, 2019, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161/2 "2019-08-28T15:53:12Z")
I forgot to include my config
> #=========================== Filebeat inputs =============================
> filebeat.inputs:
> {% if inventory\_hostname in groups['containers'] | default() %}
>
> - type: container
> paths:
> - '/var/lib/docker/containers/_/_.log'
> multiline.pattern: '\[1\]'
> multiline.negate: false
> multiline.match: after
> json.message\_key: msg
> exclude\_lines:
> - "^There are no requests to send"
> - "^Request method 'GET' not supported"
> fields:
> spenvironment.name: {{ env }}
> {% endif %}
>
> #============================= Filebeat modules ===============================
> filebeat.config.modules:
> path: ${path.config}/modules.d/\*.yml
> reload.enabled: false
>
> #==================== Elasticsearch template setting ==========================
> setup.template.settings:
> index.number\_of\_shards: 1
> index.number\_of\_replicas: 1
>
> setup.template.name: "filebeat"
> setup.template.pattern: "filebeat-\*"
>
> #============================== Kibana =====================================
> setup.kibana:
> {% for host in groups['kibana'] %}
> host: {{ host }}:5601
> {% endfor %}
>
> #============================== Elastic Output =====================================
> output.elasticsearch:
> hosts:
> {% for host in groups['elastic\_stack'] %}
> - {{ host }}:9200
> {% endfor %}
> ilm.enabled: auto
> ilm.rollover\_alias: "filebeat"
> ilm.pattern: "{now/M{YYYY.MM}}-000001"
>
> #================================ Processors =====================================
>
> processors:
>
> - add\_host\_metadata: ~
>
> processors:
>
> - add\_fields:
> target: spenvironment
> fields:
> name: {{ env }}
>
> {% if inventory\_hostname in groups['containers'] | default() %}
> processors:
>
> - add\_docker\_metadata:
> host: "unix:///var/run/docker.sock"
> {% endif %}
>
> #================================ Logging =====================================
> logging.level: warning
> logging.to\_files: true
> logging.to\_syslog: false
> logging.files:
> path: /var/log/filebeat
> name: filebeat.log
> keepfiles: 7
* * *
1. [:space:]
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [August 29, 2019, 9:15pm UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161/3 "2019-08-29T21:15:25Z")
Hi @Phil_Brady and welcome 🙂
> [@Phil\_Brady](#):
>
> Firstly can I get rid of the "e[32m" and "e[39m"?
They look like ANSI escape sequences that are used to define colors, is it possible that these logs are colored?
You can probably configure your application to don't log colored output, this is usually not useful in log files.
If not, filebeat doesn't have any feature to remove parts of the logs, you may need to use an ingest pipeline and the [gsub processor](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/gsub-processor.html).
> [@Phil\_Brady](#):
>
> Secondly, I get rid of the timestamp as there is already a field for this?
You can [define an ingest pipeline](https://www.elastic.co/guide/en/beats/filebeat/7.3/configuring-ingest-node.html) to parse your logs, there you could separate the date and the rest of the log message, and use the date in the logs as timestamp.
Before starting to implement your own pipeline, take a look to the existing [Filebeat modules](https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-modules.html), to see if there is already a module for the service generating these logs. Filebeat modules include predefined pipelines for well-known services.
> [@Phil\_Brady](#):
>
> Thirdly I am seeing these errors. How can I stop them?
It looks like Filebeat is trying to parse as JSON something that is not a JSON document. Configuration would help to diagnose this, I see you have pasted it, but it seems incorrectly formatted. Could you paste it again as preformatted text? There is a button in the toolbar with an icon like `` that can help with that.
---
### Author:  [@Phil\_Brady](https://discuss.elastic.co/u/Phil_Brady)
#### Post date: [August 30, 2019, 9:10am UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161/4 "2019-08-30T09:10:17Z")
Thanks, I will have a look at ingest pipelines.
For number 3 I fixed it by adding "encoding: plain" to filebeat.yml
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2019, 11:10am UTC](https://discuss.elastic.co/t/filebeat-docker-help/197161/5 "2019-09-27T11:10:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.