# How to interpret filebeat logs?

**URL:** https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524
**Category:** Beats
**Tags:** filebeat
**Created:** [January 5, 2022, 10:47am UTC](https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524 "2022-01-05T10:47:12Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)
#### Post date: [January 5, 2022, 10:47am UTC](https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524/1 "2022-01-05T10:47:12Z")

</div>

Hi,

I'm running filebeat 7.14.0 to ingest Netflow data, which is then stored in Elasticsearch and viewed on Kibana. When I run "filebeat -e", I will see some logs generated by filebeat every 30s. The logs are similar to what on this [page](https://discuss.elastic.co/t/how-to-read-monitoring-lines-in-filebeat-logs/195501), but they are not exactly the same. For example, I see the parts below

```auto
"input":{"netflow":{"packets":{"received":12345}}}}

```

or

```auto
"input":{"netflow":{"flows":1234,"packets":{"dropped":2345,"received":12345}}}}

```

It seems like when there is only "received" in the log (first line), I don't get any data, but when there is "flows" (second line), then I'll see data on Kibana. Netflow data is definitely continuously coming in and presumably ingested by filebeat, even though I expect drops because the ingest rate is likely higher than what filebeat can handle (~2-4Gbps).

I would like to know how to interpret the logs so as to better understand what is going on, and calculate the drop rate.

Thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2022, 12:48pm UTC](https://discuss.elastic.co/t/how-to-interpret-filebeat-logs/293524/2 "2022-02-02T12:48:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
