Filebeat logging format on Windows

Elastic Stack Beats
1

Is there a way to control the logging format used by filebeat? I'm talking about filebeat's own logging, not the logs I want to process.

For some reason, filebeat is logging to json. I don't have a logging section in my filebeat config, I'm using all the defaults. Yet, the files created in log/ are ndjson. This seems to conflict with the documentation, which states that it should be text (ref).

I tried enabling logging.to_eventlog but then it also logs as json to the event logs... As you can see from this picture, it's really hard to read :sweat_smile:

image
image2109×315 168 KB

There are no config overrides in my vars or env vars.

2

Yes, you can control Filebeat’s own logging format using the logging.json setting.

By default, it logs in JSON. To switch to plain text, just add this to your filebeat.yml:

logging.json: false

Restart Filebeat after the change. That should make logs easier to read.

3

I tried it out and couldn't make it work. I validated that my config was taken into account by switching debug logs on and off between attempts, and that part was fine.

I analzyed the documentation site; it doesn't include the json field anymore. It was there in 7.17 but disappeared in 8.0.

I am using 8.18.

Was it moved? Was it removed? Is that an oversight / should I open a bug?

Update: I see that it was deprecated in 7.16 and removed in 8. Not sure if an alternative exists. Breaking changes in 8.0 | Beats Platform Reference [8.18] | Elastic

4

As far as I know you cannot change the format of beats logs to plain text anymore, those logs are meant to be read by machines.

Not sure about Windows, but on Linux system you could use jq to pretty print the logs and make them easier to see on terminal.

The alternative would be to collect those logs, ingest them on Elasticsearch and look at them on Kibana.

5

You’re right — logging.json was deprecated in 7.16 and removed in 8.0. Unfortunately, there’s no direct replacement to force plain text logging in 8.x.

It’s not an oversight — it’s part of the breaking changes. If readability is an issue, one option is to pipe the logs through jq or another tool to prettify or reformat them.

Might still be worth opening a feedback issue if it’s affecting usability.