# Filebeat harvest logs from encyrpted file
**URL:** https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025
**Category:** Beats
**Tags:** fleet, filebeat, elastic-agent
**Created:** [May 31, 2022, 9:51am UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025 "2022-05-31T09:51:56Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)
#### Post date: [May 31, 2022, 9:51am UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025/1 "2022-05-31T09:51:56Z")
Hello people,
how would one go about collecting logs from an encrypted log file that has to be first decrypted
I have some /var/log/my\_encrypted\_log.log
to read this I have to pipe the contents to an binary that decrypts them
eg.
$ cat /var/log/my\_encrypted\_log.log | my\_decryption\_binary | less
this will show the logs in clear text format
I don't want to save all my decrypted logs in a different file since it will grow quite big and I am disk space limited.
I was thinking of sending/tailing it to an TCP/UDP/http stream but would like to do that directly via Agent, if possible. Is there a way to run arbitrary(but pre-defined) binaries?
Anyone encountered this scenario? Ideas?
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [June 1, 2022, 12:20am UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025/2 "2022-06-01T00:20:03Z")
None of the beats or the agent support this. You'd have to decrypt separately and then send to log file or directly to agent via tcp/udp...
---
### Author:  [@florinsfetea](https://discuss.elastic.co/u/florinsfetea)
#### Post date: [June 3, 2022, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025/3 "2022-06-03T12:53:39Z")
Hi Alex,
on our former Agent/Sidecar we've had a whitelist feature to allow other binaries to be run. We require something similar.
There is a new ER(internal reference number is 16281)
e.g. of the former feature where we needed to whitelist the binary directly on the host where the Agent was running
> **[Sidecar Collector Binary Whitelist Issue](https://community.graylog.org/t/sidecar-collector-binary-whitelist-issue/10164)**
>
> I’m trying to make a collector for Sysmon via the Graylog 3 sidecar functionality. I’ve created the log collection, the configuration, and applied it to a sidecar. Despite the fact I’ve updated the sidercar.yml file on the host to include the path...
>
>
> Fixes #261
Basically it's like allowing the osquery(integration) or sysmon binaries but in this case we need a custom one.
Ideally we should be able to verify the CRC or sha512 signature that binary from Fleet
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 1, 2022, 2:53pm UTC](https://discuss.elastic.co/t/filebeat-harvest-logs-from-encyrpted-file/306025/4 "2022-07-01T14:53:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.