# Log through Filebeat has hex values, but direct to Logstash does not

**URL:** <https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 1, 2018, 11:38pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123 "2018-02-01T23:38:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bladerunner512](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\
**Post date:** [February 1, 2018, 11:38pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123/1 "2018-02-01T23:38:45Z")

</div>

ELK 6.0.0/Filebeat 6.0.0

Logs are single line json:  
{"msg":"Logger in Debug mode","sev":"DEBUG","ts":"2017-11-15T19:38:44:0223Z"}

This works fine:  
$ nc localhost 5044 \< json-log.log

Same file put in Filebeat log directory has hex values:  
@version:1 host:dockerelkmaster\_filebeat\_1.dockerelkmaster\_elk @timestamp:February 1st 2018, 16:54:21.862 @metdata.ip\_address:172.18.0.5 message:2W\u0000\u0000\u0000\u00042C\u0.....etc.

filebeat.yml:  
filebeat.prospectors:

- type: log  
encoding: utf-8

output.logstash:  
hosts: ["logstash:5044"]

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [February 2, 2018, 2:21pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123/2 "2018-02-02T14:21:20Z")

</div>

Can you share a sample log file which exhibits this behavior?

---

<div class="post-metadata">

**Author:** ![bladerunner512](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\
**Post date:** [February 2, 2018, 3:04pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123/3 "2018-02-02T15:04:46Z")

</div>

The line mentioned above is the log file contents:  
Logs are single line json:  
{"msg":"Logger in Debug mode","sev":"DEBUG","ts":"2017-11-15T19:38:44:0223Z"}

---

<div class="post-metadata">

**Author:** ![bladerunner512](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\
**Post date:** [February 2, 2018, 4:13pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123/4 "2018-02-02T16:13:30Z")

</div>

Since log file are all JSON I've removed logstash in filebeat.yml and replaced with elasticsearch:

#output.logstash:  
#hosts: ["logstash:5044"]

output.elasticsearch:  
hosts: ["elasticsearch:9200"]

This works great, but would still like to figure out issue with Logstash for possible use in the future.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 4:14pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123/5 "2018-03-02T16:14:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.