# Remove first few characters from log file - filebeat

**URL:** <https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 30, 2021, 2:53pm UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475 "2021-06-30T14:53:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [June 30, 2021, 2:53pm UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475/1 "2021-06-30T14:53:11Z")

</div>

Hi Team,

We are using filbeat as an agent to pull the logs from different servers, a few of the logs have prefixes that get stuck in front of actual log events.  
In order to parse the log files we need to remove these prefixes from all the events, the prefix offset is ~ 50 characters.  
Is there any way using any processors we can remove the first few characters from the log file using filebeat??

---

<div class="post-metadata">

**Author:** ![Khairul\_Anuar\_bin\_Ab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khairul_anuar_bin_ab/32/49908_2.png) [@Khairul\_Anuar\_bin\_Ab](https://discuss.elastic.co/u/Khairul_Anuar_bin_Ab)\
**Post date:** [July 1, 2021, 10:37am UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475/2 "2021-07-01T10:37:13Z")

</div>

I would suggest to use logstash instead of filebeat and filter the unwanted prefixes.

---

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [July 1, 2021, 2:27pm UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475/3 "2021-07-01T14:27:54Z")

</div>

Hi,

Thanks for responding.  
But the log events are in multiline and the prefix stuff is coming in all the lines, which is causing issues in sending the multiline event as a single line to logstash.

Example

```auto
<Prefix>timestamp log level ID log message 
<Prefix>	at.arg.<Stacktrace>
<Prefix>	at.arg.<Stacktrace>
<Prefix>	at.arg.<Stacktrace>
<Prefix>	at.arg.<Stacktrace>

```

If I send without removing Prefix from the log file, it will not be considered as multiline!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2021, 4:28pm UTC](https://discuss.elastic.co/t/remove-first-few-characters-from-log-file-filebeat/277475/4 "2021-07-29T16:28:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.