# Issue with Weird spaces with Filebeat in windows Log

**URL:** <https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 27, 2020, 9:37am UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415 "2020-10-27T09:37:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![enrique.villar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique.villar/32/77925_2.png) [@enrique.villar](https://discuss.elastic.co/u/enrique.villar)\
**Post date:** [October 27, 2020, 9:37am UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/1 "2020-10-27T09:37:13Z")

</div>

Good day. I try to index some windows (MSSQL) logs. This logs are in plain text.

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/7/e74752f567de95576a28f8e78291f6833cac2147.png)

Some logs are multiline

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54158818ba449b83a81875b35a6b8baf2bb44a0c.png)

So, in Filebeat is configure:

```auto
- type: log
  enabled: true
  paths:
    - D:\logs\*.log #example path
  multiline.pattern: '^<Header|^\S*?!'
  multiline.negate: true
  multiline.match: after
  tags: ["reporting_indra"]
output.logstash:
    hosts: ["elk:5044"]
# The rest options are by default.

```

In logstash I have a filter to mutate tags and a output if to asign index "reporting\_indra" to tag "reporting\_indra".

So. I can see the logs in Kibana.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de7a29862a1ea8112cece7ec3492c545dc3eff07.png)

But, if I search a word..

![image](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a6237809674c29a0f32568253dbac182eba78f4.png)

If I filter by value I get this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/042384ace551b70a98e8e34f56fb6ad00fa43890.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d3ef834dfd52e42ecb344ec0d13bd741ec90af7.png)  
So, if I replace the characters for another "word" works, but always with that symbols in beetwen.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89b4fcb867b49bce8c781b569643f6797fbc8fe2.png)

I want to search directly with a normal word. Maybe I need to filter again?

Thanks so much.

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [October 27, 2020, 10:21am UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/2 "2020-10-27T10:21:41Z")

</div>

Hi! Not sure what these symbols are but `Library` seems to not be a single term since it's in the same string with other terms: `Library!WindowService...`. Maybe this is something you need to solve by splitting these terms?

C.

---

<div class="post-metadata">

**Author:** ![enrique.villar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique.villar/32/77925_2.png) [@enrique.villar](https://discuss.elastic.co/u/enrique.villar)\
**Post date:** [October 27, 2020, 2:07pm UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/3 "2020-10-27T14:07:30Z")

</div>

Thank you, Chris.

That's right. ´!´ is a separator.

I will indagate how that logs are formated, but I prefer don't touch the origin since is a regular txt file.

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [October 29, 2020, 10:53am UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/4 "2020-10-29T10:53:34Z")

</div>

Hey! You can maybe ship the logs to Logstash and manually split them there using grok patterns so as to avoid changing your source.

C.

---

<div class="post-metadata">

**Author:** ![enrique.villar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrique.villar/32/77925_2.png) [@enrique.villar](https://discuss.elastic.co/u/enrique.villar)\
**Post date:** [October 29, 2020, 1:00pm UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/5 "2020-10-29T13:00:49Z")

</div>

This is my logstash conf:

```auto
input {
  beats {
    port => 5044
  }
}

filter {
    if "beats_input_codec_plain_applied" in [tags] {
        mutate {
            remove_tag => ["beats_input_codec_plain_applied"]
        }
    }
    if "rs_indra" in [tags] {
        grok {
           match => { "message" => "%{WORD:evento}!%{WORD:origen}!%{WORD:codigo}!%{DATE_US:fecha}-%{TIME:hora}:: %{GREEDYDATA:mensaje}" }
        }
    }
}
output {
        if "nginx-proxy-reverso" in [tags] {
                elasticsearch {
                        hosts => "localhost:9200"
                        manage_template => false
                        index => "nginx-proxy-reverso2-"
                        document_type => "%{[@metadata][type]}"
                }
        }
        else if "rs_indra" in [tags] {
               elasticsearch {
                        hosts => "localhost:9200"
                        manage_template => false
                        index => "rs_indra"
                        document_type => "%{[@metadata][type]}"
                }
        }
        else {
                elasticsearch {
                        hosts => "localhost:9200"
                        manage_template => false
# index => "nginx-proxy-reverso-%{[@metadata][beat]}-%{+Y YYY.MM.dd}"
                        index => "file-beat2-"
# setup.template.name: "nginx-proxy-reverso"
# setup.tamplate.pattern: "nginx-proxy-reverso-"
                        document_type => "%{[@metadata][type]}"
                }
        }
}

```

but I get this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76d70876542545f806d69991a49a496c62ee2947.png)

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [October 29, 2020, 2:36pm UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/6 "2020-10-29T14:36:31Z")

</div>

If the grok pattern is able to successfully parse the messages then I expect that `evento` field should have the value of `library`.

Do you see any errors regarding the parsing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2020, 4:36pm UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415/7 "2020-11-26T16:36:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.