# Filebeat to count events picked up before sending to elasticsearch or logstash
**URL:** https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631
**Category:** Beats
**Tags:** filebeat
**Created:** [May 29, 2018, 7:26am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631 "2018-05-29T07:26:33Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)
#### Post date: [May 29, 2018, 7:26am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/1 "2018-05-29T07:26:33Z")
Hello
Is it possible?
Scenario:
We have a file that is being picked up by filebeat. The prospectors splits up the content of the file into multiple events. Now, how do we capture the total events before it passes to output?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [June 1, 2018, 11:15am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/2 "2018-06-01T11:15:45Z")
May I ask why do you need the number of messages before sending it to outputs?
Filebeat provides logs metrics by default every 30s. It contains info on how many events were sent, how many were filtered, etc.
```auto
{"pipeline": {
"clients": 0,
"events": {
"active": 0,
"filtered": 1,
"published": 810,
"retry": 50,
"total": 811
},
"queue": {
"acked": 810
}
}
```
---
### Author:  [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)
#### Post date: [June 4, 2018, 2:39am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/3 "2018-06-04T02:39:59Z")
Hi,
We are trying to figure out the number of logs picked up by the prospectors then compared it to elasticsearch data.
---
### Author:  [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)
#### Post date: [June 4, 2018, 2:44am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/4 "2018-06-04T02:44:22Z")
Does that mean from the sample above, the total events picked up by filebeat is 811 before indexing it to elasticsearch?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [June 4, 2018, 10:49am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/5 "2018-06-04T10:49:41Z")
Yes, Filebeat read 811 events as `pipeline.events.total` suggests. But one message was filtered out (`pipeline.events.filtered`) and not published. So in the end 810 was forwarded to Elasticsearch, as seen in `pipeline.events.published`.
---
### Author:  [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)
#### Post date: [June 5, 2018, 3:05am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/6 "2018-06-05T03:05:35Z")
thanks for you reply @kvch! Much appreciated!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2018, 3:09am UTC](https://discuss.elastic.co/t/filebeat-to-count-events-picked-up-before-sending-to-elasticsearch-or-logstash/133631/7 "2018-07-03T03:09:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.