# TTY logging decoding

**URL:** <https://discuss.elastic.co/t/tty-logging-decoding/150548>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [October 1, 2018, 10:11am UTC](https://discuss.elastic.co/t/tty-logging-decoding/150548 "2018-10-01T10:11:58Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 2, 2018, 10:35am UTC](https://discuss.elastic.co/t/tty-logging-decoding/150548/6 "2018-10-02T10:35:32Z")

</div>

I realised that the events you are pasting don't come from Auditbeat, but Filebeat. Those are log lines read from `/var/log/audit/audit.log` and not auditd events reported by Auditbeat.

I think you have Filebeat feeding logs to Elasticsearch too and got confused.

An Auditbeat event looks like this:

```auto
  "@timestamp": "2018-10-02T10:20:56.849Z",
  "@metadata": {
    "beat": "auditbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
  "beat": {
    "name": "localhost.localdomain",
    "hostname": "localhost.localdomain",
    "version": "7.0.0-alpha1"
  },
  "event": {
    "category": "TTY",
    "type": "tty",
    "action": "typed",
    "module": "auditd"
  },
  "user": {
    "name_map": {
      "auid": "vagrant",
      "uid": "root"
    },
    "auid": "1000",
    "uid": "0"
  },
  "process": {
    "pid": "1680",
    "name": "yum"
  },
  "auditd": {
    "data": {
      "data": "y\n", # <- KEYSTROKES HERE
      "major": "136",
      "minor": "0"
    },
    "summary": {
      "how": "yum",
      "actor": {
        "primary": "vagrant",
        "secondary": "root"
      },
      "object": {
        "type": "keystrokes",
        "primary": "y\n"
      }
    },
    "sequence": 604,
    "result": "unknown",
    "session": "3"
  },
  "host": {
    "name": "localhost.localdomain"
  }
}

```

If you're using Kibana to inspect the events, make sure you have an auditbeat index pattern selected, not filebeat.

---

_[View the full topic](https://discuss.elastic.co/t/tty-logging-decoding/150548)._