# Multiple 'failed to format' messages in log stream

**URL:** <https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579>\
**Category:** Metrics\
**Created:** [December 5, 2018, 5:32pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579 "2018-12-05T17:32:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenbergquist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kenbergquist/32/37899_2.png) [@kenbergquist](https://discuss.elastic.co/u/kenbergquist)\
**Post date:** [December 5, 2018, 5:32pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579/1 "2018-12-05T17:32:36Z")

</div>

I'm seeing the message 'failed to format message from /var/log/audit/audit.log' repeatedly in the Infrastructure app log stream. Disabling the auditd module stops the messages, as you'd expect. Any insight would be sincerely appreciated.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [December 5, 2018, 6:08pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579/2 "2018-12-05T18:08:31Z")

</div>

Hi @kenbergquist,

thanks for trying out the Logs UI. This is a shortcoming of the current message formatting heuristic, which fail to derive a suitable "message" from the auditd event. Would it be possible for you to find out which events are displayed that way?

---

<div class="post-metadata">

**Author:** ![kenbergquist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kenbergquist/32/37899_2.png) [@kenbergquist](https://discuss.elastic.co/u/kenbergquist)\
**Post date:** [December 5, 2018, 6:22pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579/3 "2018-12-05T18:22:33Z")

</div>

Hello @weltenwort. Thanks for the quick reply. To the best of my ability to tell, all events in audit.log are failing. I am also seeing it now on the mysql module, for mysql-error.log. This is on Ubuntu 16.04.5 LTS if it helps.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [December 6, 2018, 12:36pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579/4 "2018-12-06T12:36:26Z")

</div>

Thanks for providing these details. I have created [an issue in the Kibana repo](https://github.com/elastic/kibana/issues/26759) to track this problem. Feel free to add more details there if you come across them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 12:36pm UTC](https://discuss.elastic.co/t/multiple-failed-to-format-messages-in-log-stream/159579/5 "2019-01-03T12:36:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.