# Filebeat include\_lines issue **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 27, 2019, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211 "2019-12-27T16:45:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![RunningSmurf](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)\ **Post date:** [December 27, 2019, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211/1 "2019-12-27T16:45:05Z")
Hello, I have Filebeat installed on a Windows server. I configured it to read logs from SQL Server. I can see that all lines are individually passed to ES, as I can see them in Kibana. My goal is to only send the lines that contain the sentence "Login failed for user" The documentation is pretty straight forward: The following example exports all log lines that contain `sometext` filebeat.inputs: - type: log ... include\_lines: ['sometext'] This is my yml file: filebeat.inputs: - type: log paths: - M:\sqlroot\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG include\_lines: ['Login failed for user'] But this results in no messages being forwarded to ES. I have tried multiple wildcard inputs, but no luck. Would anyone see anything wrong with my configuration? Any help would be greatly appreciated. Thanks! Sincerely, RS ---
**Author:** ![RunningSmurf](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)\ **Post date:** [December 27, 2019, 4:47pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211/2 "2019-12-27T16:47:28Z")
Just a quick note: the indentation in the message above is off. The include\_lines is lined-up under the 'p' in 'paths'.... Thanks! ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [December 30, 2019, 2:30pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211/3 "2019-12-30T14:30:39Z")
Could you please format your configuration file? Please also share a few example logs you are trying to filter out. Debug logs of Filebeat when reading these files would be also helpful (`./filebeat -e -d "*"`). ---
**Author:** ![RunningSmurf](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@RunningSmurf](https://discuss.elastic.co/u/RunningSmurf)\ **Post date:** [December 30, 2019, 9:12pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211/4 "2019-12-30T21:12:39Z")
Good afternoon, Thank you for your response. I am not sure what you mean what formatting my configuration file. Do you mean that I need to display here in the proper format? I have tried to attach it as a screenshot... Hopefully it will show properly. ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb0cd031b1c46d04ed463ef5edf0065539ea9f61.png) Here is an example of the log that I am created with the error that I want to include: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a57084c236f7ee0e9c6a7985cc53761d568bb0c.png) When I run filebeat with the -e -d "\*" I see the following (while it is running, I cause the SQL login error that I want to be filtered and sent to ElasticSearch): ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e26506af2d081b9670904491da6cc38caa2f181a.png) Thank you for your help! Sincerely, RS ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 27, 2020, 9:12pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-issue/213211/5 "2020-01-27T21:12:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.