# Filebeat for binary files?

**URL:** https://discuss.elastic.co/t/filebeat-for-binary-files/46479
**Category:** Beats
**Tags:** filebeat
**Created:** [April 6, 2016, 6:50am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479 "2016-04-06T06:50:35Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![rahin88](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahin88/32/8925_2.png) [@rahin88](https://discuss.elastic.co/u/rahin88)
#### Post date: [April 6, 2016, 6:50am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/1 "2016-04-06T06:50:35Z")

</div>

Hello Folks,

I am new to whole Logstash/ELK. But I am wondering if I can use filebeat for streaming binary data to network ?  
Here is what I am trying to do.

Multiple processes (in hundreds) have lib in them to encode data and write to corresponding "logs files"(binary encoded files to save space) of the processes. If we want to read them "log files" in human readable format we can to by running it them a decoder I have.

Now what I want to do is stream the "log files" to a remote location via filebeat and run my decoder there. So is this possible via logstash or filebeat ?

This is my firstpost and any help is much appreciated. Thanks.

P.S. I can run my decoder where the "log files" are being generated and feed the output location to filebeat but It kills both my cpu and network. So i want to stream the encoded files incrementally and use my decoder on the cloud.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 6, 2016, 6:54am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/2 "2016-04-06T06:54:51Z")

</div>

Filebeat is designed to process text based logs line by line, and as far as I know it is not able to handle binary logs.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 6, 2016, 10:59am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/3 "2016-04-06T10:59:31Z")

</div>

filebeat currently tails text files only looking for newlines (even removing newlin characters). You don't want to run this on binary files as a random sequence of '\r\n' in binary and just '\n' in binary you wont be able distinguish in your decoder (if any '\n' is missing you will never see your content).

There have been ideas to make filebeat prospectors more plugin-like for improved extensiblity, but this is not possible to date.

---

<div class="post-metadata">

### Author: ![rahin88](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahin88/32/8925_2.png) [@rahin88](https://discuss.elastic.co/u/rahin88)
#### Post date: [April 7, 2016, 9:54am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/4 "2016-04-07T09:54:07Z")

</div>

Thanks Steffen and Christian,

What do you guys suggest I do. Now I am planning on getting to write my own plugin for logstash or are there any plugins that do this already ? I'll post the same in logstash forum.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 7, 2016, 11:45am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/5 "2016-04-07T11:45:58Z")

</div>

Binary encoded files... is a very very generic statement. Dealing with binary (and sometimes ascii ) content one needs specialised parsers being able to extract content. Dealing with text based log files is fortunately relatively straight forward as using newlines to separate log entries is a very commonly accepted habit.

You can check [logstash input/filter/codec plugins](https://www.elastic.co/guide/en/logstash/current/index.html) for any support.

---

<div class="post-metadata">

### Author: ![veeragadag](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@veeragadag](https://discuss.elastic.co/u/veeragadag)
#### Post date: [June 9, 2017, 11:14am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/6 "2017-06-09T11:14:45Z")

</div>

Hi Christian,

I am facing a similar problem: sending hexdump file from client running filebeat to server running logstash.  
Since this was discussed almost a year ago, is there any plugin available now to filebeat to send hexdump / binary files?

Also is it possible to transfer files from client to server as is, that is without filebeat interpreting the content of file?

Thanks & Best wishes,  
Veera

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 13, 2017, 6:51am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/7 "2017-06-13T06:51:20Z")

</div>

This is currently not possible.

---

<div class="post-metadata">

### Author: ![bonsshah](https://avatars.discourse-cdn.com/v4/letter/b/c67d28/32.png) [@bonsshah](https://discuss.elastic.co/u/bonsshah)
#### Post date: [April 8, 2019, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/8 "2019-04-08T15:48:42Z")

</div>

Is there any support now for binary files from Filebeat ?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 8, 2019, 5:15pm UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/9 "2019-04-08T17:15:48Z")

</div>

No, not that I am aware of. What kind of binary files are you looking to process?

---

<div class="post-metadata">

### Author: ![pdegran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pdegran/32/75783_2.png) [@pdegran](https://discuss.elastic.co/u/pdegran)
#### Post date: [September 17, 2020, 6:52pm UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/10 "2020-09-17T18:52:34Z")

</div>

Is there a way/option to "exclude" non-string data? I have log files which provides failing data records where sometime the SOH (x01) STX (x02) and ETX (x03) is part of the reported failing data.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 4:18am UTC](https://discuss.elastic.co/t/filebeat-for-binary-files/46479/11 "2022-11-04T04:18:00Z")

</div>


