# How to debug log entries which just contain "%{host} %{message}" solved!

**URL:** <https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597>\
**Category:** Logstash\
**Created:** [May 10, 2016, 12:18am UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597 "2016-05-10T00:18:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 10, 2016, 12:18am UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/1 "2016-05-10T00:18:42Z")

</div>

I configured logstash to updload to s3. When I check the files on s3, they are full of entries like this:  
2016-05-09T23:27:31.811Z %{host} %{message}  
2016-05-09T23:27:31.811Z %{host} %{message}  
2016-05-09T23:27:31.809Z %{host} %{message}  
2016-05-09T23:27:31.810Z %{host} %{message}  
2016-05-09T23:27:31.827Z %{host} %{message}  
2016-05-09T23:27:31.828Z %{host} %{message}

how to debug what's creating such messages? How to remove them?

When I change the output from s3 to "file" I don't see those messages in the output file

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 6:28am UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/2 "2016-05-10T06:28:07Z")

</div>

What do your messages actually look like? Use a `stdout { codec => rubydebug }` output to get a raw dump.

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 10, 2016, 5:59pm UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/3 "2016-05-10T17:59:02Z")

</div>

Since I use a managed service to run log stash, I used the debug codec in the file output.  
None of the messages contain just %{host} %{message}

It seems to be only in the s3 output.

the content of the messages is confidential, so is it possible to dm you?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2016, 6:09am UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/4 "2016-05-11T06:09:37Z")

</div>

I don't offer private support so please try to find a way to obfuscate the confidential parts. But anyway, you're using the default plain codec for the s3 output. You'll want to use json\_lines instead or possibly some other codec that produces logs in a format that keeps all fields.

---

<div class="post-metadata">

**Author:** ![davidweir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidweir/32/9678_2.png) [@davidweir](https://discuss.elastic.co/u/davidweir)\
**Post date:** [May 11, 2016, 5:31pm UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/5 "2016-05-11T17:31:28Z")

</div>

Adding the json\_lines codec seems to work.  
Why doesn't the s3 output plugin work by default? why does it need that codec field defined?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 11, 2016, 9:27pm UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/6 "2016-05-11T21:27:04Z")

</div>

Well, not everyone wants JSON logs. Having it default to the plain codec maybe wasn't the wisest decision when the plugin was introduced, but changing that default now would be somewhat painful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597/7 "2017-07-06T04:58:06Z")

</div>