# How to decode non-text logs

**URL:** <https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796>\
**Category:** Beats\
**Created:** [September 29, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796 "2016-09-29T09:23:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![harrytewkesbury](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harrytewkesbury/32/11010_2.png) [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)\
**Post date:** [September 29, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796/1 "2016-09-29T09:23:13Z")

</div>

Hi,

We have some logs in the "FixLog" format, for which users can generally use a tool called fixlog on the machine to read them as one would use the "less" command.

[http://www.fixtradingcommunity.org/](http://www.fixtradingcommunity.org/)  
[http://fixlogviewer.com/](http://fixlogviewer.com/)

These logs are annoyingly not regular text logs, but not far off. Is there a way to use a third party tool for filebeat to parse logs? Or any suggestions as to how best to deal with a log that filebeat can't read natively?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 3, 2016, 7:39am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796/2 "2016-10-03T07:39:56Z")

</div>

Can you share an example of such a log?

---

<div class="post-metadata">

**Author:** ![harrytewkesbury](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harrytewkesbury/32/11010_2.png) [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)\
**Post date:** [October 3, 2016, 8:16am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796/3 "2016-10-03T08:16:50Z")

</div>

Turns out I am an idiot, and actually Filebeat parses it nicely - I just couldn't read it on the command line.

That said, I wonder if there's a way to direct another application at Filebeat to read the log. I can't imagine many instances where this is necessary (especially on Linux) but I bet there are strangely formatted logs on Windows that would require a particular application to read. Are there any ways in which these could be ingested like this?

Or, from another angle, what if one wanted to ingest compressed logs without having to decompress them - ad-hoc ingestion from archived logs for example. I've needed to do this myself more than once.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 3, 2016, 8:18am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796/4 "2016-10-03T08:18:48Z")

</div>

I assume that is what you are looking for? [https://github.com/elastic/beats/issues/637](https://github.com/elastic/beats/issues/637) For the common case of a compress log file the idea is to have it as a separate prospector in filebeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2016, 9:24am UTC](https://discuss.elastic.co/t/how-to-decode-non-text-logs/61796/5 "2016-10-20T09:24:01Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.