# Ingesting IBM BigFix Client Logs

**URL:** https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437
**Category:** Beats
**Tags:** beats-module
**Created:** [November 8, 2022, 1:06pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437 "2022-11-08T13:06:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)
#### Post date: [November 8, 2022, 1:06pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437/1 "2022-11-08T13:06:00Z")

</div>

I am needing to ingest the IBM BigFix client logs located at `C:\Program Files (x86)\BigFix Enterprise\BES Client\_BESData\_Global\Logs`. Is there either a Beat module or Logstash plugin which would handle parsing these logs? They are one file per day with metadata at the top and events in lines below. Any thoughts on handling such data would be much appreciated!

---

<div class="post-metadata">

### Author: ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)
#### Post date: [December 6, 2022, 12:01pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437/2 "2022-12-06T12:01:30Z")

</div>

Just doing a ping in case anyone out there had an answer...

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 6, 2022, 12:47pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437/3 "2022-12-06T12:47:05Z")

</div>

If there is nothing about it in the documentatin, then there is no native module to parse these logs.

You will need to create a pipeline with logstash or filebeat to parse it.

How does the log looks like? Please share a sample message.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2023, 2:47pm UTC](https://discuss.elastic.co/t/ingesting-ibm-bigfix-client-logs/318437/4 "2023-01-03T14:47:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
