Spaces are missing in filestream when logging 'message' to console

Elastic Stack Beats
,
1

I am running filebeat 8.16.1 on an ansible-operator Docker image (operator-framework/ansible-operator:v1.35.0).

I have set up the filebeat.yml as filestream to collect the ansible operator logs, however, I have noticed that when I set the filebeat output to console that spaces are missing.

I will take the last line of the log file as an example here.

Original log file:

^[[0;33mlocalhost^[[0m                  : ^[[0;32mok=202 ^[[0m ^[[0;33mchanged=1   ^[[0m unreachable=0    failed=0    ^[[0;36mskipped=104 ^[[0m rescued=0    ignored=0

when the filebeat output is set to:

output.console:
  enabled: true

the output is:

 "message": "\u001b[0;33mlocalhost\u001b[0m : \u001b[0;32mok=202 \u001b[0m \u001b[0;33mchanged=1 \u001b[0m unreachable=0 failed=0 \u001b[0;36mskipped=104 \u001b[0m rescued=0 ignored=0 ",

and when the filebeat output is set to:

output.console:
  codec.format:
    string: '%{[message]}'

the output is:

localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0

however, the expected output here should be:

localhost                  : ok=202  changed=6    unreachable=0    failed=0    skipped=104  rescued=0    ignored=0

As you can see the spaces are missing/merged into one?. I could not find anything in the docs about output.console or codec.format to change this behaviour.

2

I also tried setting ANSIBLE_NOCOLOR=True in the pod which suppresses colorizing output to get rid of ANSI like ^[[0;33m in the logs.

The same line in the original log file turned into:

localhost                  : ok=202  changed=6    unreachable=0    failed=0    skipped=104  rescued=0    ignored=0

however it made no difference as the filebeat console output still had the spaces missing:

"message": "localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0 "

or

localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0
3

It actually turned out to be related to OpenShift (where this pod is running). In the pod logs I had to toggle "Wrap lines" to get the full formatted view in the console. Otherwise, it appears to squash spaces together.