# Filebeat mssql

**URL:** <https://discuss.elastic.co/t/filebeat-mssql/284175>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 14, 2021, 11:05am UTC](https://discuss.elastic.co/t/filebeat-mssql/284175 "2021-09-14T11:05:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcel\_Palme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_palme/32/61178_2.png) [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\
**Post date:** [September 14, 2021, 11:05am UTC](https://discuss.elastic.co/t/filebeat-mssql/284175/1 "2021-09-14T11:05:21Z")

</div>

I'm trying to transfer the mssql log to elastic. This also works so far, but I get the errors all in text fields

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32e7f517d39ceda828a938eead5af3c98d4b5996.png)  
How can I split this field into individual fields or how can I search for certain keywords in this field

Thanks  
Marcel

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [September 14, 2021, 11:30am UTC](https://discuss.elastic.co/t/filebeat-mssql/284175/2 "2021-09-14T11:30:15Z")

</div>

Hey @Marcel_Palme,

Are you using the `mssql` module?

If that's the case it may need some enhancements to better parse these logs, could you share some of the log lines you would expect to see better parsed?

---

<div class="post-metadata">

**Author:** ![Marcel\_Palme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_palme/32/61178_2.png) [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\
**Post date:** [September 14, 2021, 11:46am UTC](https://discuss.elastic.co/t/filebeat-mssql/284175/3 "2021-09-14T11:46:50Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/65c9284fe2b5b5adfd39b363426eecc009f7e5bc.png)

yes i use the mssql module. the configuration currently looks like this - only the paths to the log files are in it. I get the information, yes - see the picture in my first post, but I can't search through it or filter it

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 14, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-mssql/284175/4 "2021-09-14T21:49:50Z")

</div>

Please don't post pictures of text or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2021, 11:50pm UTC](https://discuss.elastic.co/t/filebeat-mssql/284175/5 "2021-10-12T23:50:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.