# Unrecognizable messages

**URL:** <https://discuss.elastic.co/t/unrecognizable-messages/224336>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 20, 2020, 1:53am UTC](https://discuss.elastic.co/t/unrecognizable-messages/224336 "2020-03-20T01:53:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [March 20, 2020, 1:53am UTC](https://discuss.elastic.co/t/unrecognizable-messages/224336/1 "2020-03-20T01:53:23Z")

</div>

I have installed filebeats on Centos6  
I have the filebeats reading the /var/log/\*.log files (just using the default filebeats.yml config)  
I have filebeats sending the events to logstash then to ES.  
All I see is messages that look like this?

What is this and what did I miss?

`2F4PF\aM\xC3I#\f\x9A0\xD6B\xAFE\x95\xF8u\xBC\xBA\x8A\u0017\e\u001Co\x9A\xF4+\xD1\u0011\xB5\xF8d&BȲ\r\xE6\u0018\xAA\x83\u007F\xA8\xB7\"S\x9D\u000Ef\u000F\xA2S\xFD0\xB0\xA6\xE0\xDCU\xF5\xE2F0FE\x8EB\x80*\u00117\xB9v0\u0004\xA4\x9E\xE8\xF6CA\u001D\\ͧ\x9Ekcj\"R\xF8G\x84\xAC\xD7hI\xE1\xA0\xFA\xB2\xA8\x84\u0006\x8F\xD4OU\xE06\xC2\u0012V\u0012\xB8-\xE7#\xEA3u\xF0Ķ:\\'\x84\xB1\xD6ӷ:\xD6\xF7\u0016\x93[\x9Bk\xFA\u007F\xAE\x97i\xAA\xAA\xA1>\u0004\x90\u007FB\xC8\xF2\xB4\u0000\xE9\x99\u0000$=\xEF\xAC:m\u000F\u001CO\xC1g▻\xAE\xBAJ\xF0\xADis\u001A\xEChdjq\x9F\xB9`

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 23, 2020, 6:38pm UTC](https://discuss.elastic.co/t/unrecognizable-messages/224336/2 "2020-03-23T18:38:36Z")

</div>

1. What version of Filebeat and Logstash are you using?

2. For debugging purposes, could you temporarily set `output.logstash.enabled: false` and `output.console.enabled: true`? This will output the logs being harvested by Filebeat to the console instead of sending them to Logstash. Then restart Filebeat and check the console output to see if you're seeing the same garbled characters as you posted. That'll at least help us narrow down to where the problem might be in Filebeat -\> Logstash -\> ES.

Thanks,

Shaunak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 6:38pm UTC](https://discuss.elastic.co/t/unrecognizable-messages/224336/3 "2020-04-20T18:38:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.