# Spaces are missing in filestream when logging 'message' to console

**URL:** <https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [March 10, 2025, 9:40am UTC](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637 "2025-03-10T09:40:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rawa-resul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rawa-resul/32/141901_2.png) [@rawa-resul](https://discuss.elastic.co/u/rawa-resul)\
**Post date:** [March 10, 2025, 9:40am UTC](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637/1 "2025-03-10T09:40:27Z")

</div>

I am running filebeat 8.16.1 on an ansible-operator Docker image (operator-framework/ansible-operator:v1.35.0).

I have set up the filebeat.yml as filestream to collect the ansible operator logs, however, I have noticed that when I set the filebeat output to console that spaces are missing.

I will take the last line of the log file as an example here.

Original log file:

```auto
^[[0;33mlocalhost^[[0m : ^[[0;32mok=202 ^[[0m ^[[0;33mchanged=1 ^[[0m unreachable=0 failed=0 ^[[0;36mskipped=104 ^[[0m rescued=0 ignored=0

```

when the filebeat output is set to:

```auto
output.console:
  enabled: true

```

the output is:

```auto
 "message": "\u001b[0;33mlocalhost\u001b[0m : \u001b[0;32mok=202 \u001b[0m \u001b[0;33mchanged=1 \u001b[0m unreachable=0 failed=0 \u001b[0;36mskipped=104 \u001b[0m rescued=0 ignored=0 ",

```

and when the filebeat output is set to:

```auto
output.console:
  codec.format:
    string: '%{[message]}'

```

the output is:

```auto
localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0

```

however, the expected output here should be:

```auto
localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0 

```

As you can see the spaces are missing/merged into one?. I could not find anything in the docs about **output.console** or **codec.format** to change this behaviour.

---

<div class="post-metadata">

**Author:** ![rawa-resul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rawa-resul/32/141901_2.png) [@rawa-resul](https://discuss.elastic.co/u/rawa-resul)\
**Post date:** [March 10, 2025, 4:25pm UTC](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637/2 "2025-03-10T16:25:00Z")

</div>

I also tried setting `ANSIBLE_NOCOLOR=True` in the pod which suppresses colorizing output to get rid of ANSI like `^[[0;33m` in the logs.

The same line in the original log file turned into:

```auto
localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0

```

however it made no difference as the filebeat console output still had the spaces missing:

```auto
"message": "localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0 "

```

or

```auto
localhost : ok=202 changed=6 unreachable=0 failed=0 skipped=104 rescued=0 ignored=0

```

---

<div class="post-metadata">

**Author:** ![rawa-resul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rawa-resul/32/141901_2.png) [@rawa-resul](https://discuss.elastic.co/u/rawa-resul)\
**Post date:** [March 12, 2025, 3:53pm UTC](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637/3 "2025-03-12T15:53:23Z")

</div>

It actually turned out to be related to OpenShift (where this pod is running). In the pod logs I had to toggle "Wrap lines" to get the full formatted view in the console. Otherwise, it appears to squash spaces together.