Filebeat Inserts \t in place of tabs in Logstash

Elastic Stack Beats
1

Hi,

Need some help, I am shipping the logs using filebeat to remote Logstash and my log contains tabs in between. Following LS filter was working perfectly until yesterday.

kv {
  value_split => "::"
  trim_value => ":"
  field_split => "\\t"
  include_keys => ["HOSTNAME", "HOSTSTATE", "HOSTSTATETYPE"]
}

However I tried to modify my filter to include other logs and it's broken now as filebeat is replaceing tab with \t while shipping the logs. I've reverted all my changes to the original filter but still no luck.

Just to be sure it is not filter which is causing the issue I've removed the filter completely, but still getting the same error.

Jul 10 16:49:11 LSSERVER logstash: "message" => "DATATYPE::HOSTPERFDATA\tTIMET::1531241345\tHOSTNAME::BEATSSERVER\tHOSTPERFDATA::\tHOSTCHECKCOMMAND::check-host-alive\tHOSTSTATE::UP\tHOSTSTATETYPE::HARD",

I can rewrite the filter to split the fields on \t but I want to understand what is it causing this issue.

Any help is greately appreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.