# Weird Log Output **URL:** \ **Category:** Logstash\ **Created:** [July 10, 2018, 9:32am UTC](https://discuss.elastic.co/t/weird-log-output/139312 "2018-07-10T09:32:23Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 10, 2018, 9:32am UTC](https://discuss.elastic.co/t/weird-log-output/139312/1 "2018-07-10T09:32:23Z")
I am getting a weird log output and it seems to be an issue with grok Here is a sample of the logs: > July 10th 2018, 09:31:00.427 type:random\_logs @timestamp:July 10th 2018, 09:31:00.427 tags:_grokparsefailure host:10.130.33.29 @version:1 message:V4\u0010\x8C\x88e\xAB\xF4j\x86 \u001D\u0001B\xA5)Ƿ\xF5\xD1!\u0010\u0015\x82\r\xF3e\x82&\xD3\t\x90\xAE\xA7nm\xF7\u000EX\x85\xC3\u0004OxF\xD1\xD5$ц\a3\xD3\t\xDE\u0019\u0010̨\u001D\xE2-2\xB8\u0003\x89\xAE1\x92Am\x92\u001C\xA41D2\u001E\x98\xEA-\xEE\xD1\xD9\u001Eԏ\xC6\u0003St\xA4\x89J\xDCPA\u0012ˊ\xC9,\xFA\x95\u0015\x8FPe]a\x8F\xC9\xE5?Ir\xF4\xC3Nr9{2;\xDEϿ\xB4\u000Fr\xBC0\xE3\xEC\xE4\xD9\u001E\x87\u001A\xCDAyN4\xA0s\xE9\u0002\xF3\u0002\xE6'\rRc1\u0014C\x9D\u0006\u0006F\xF3rc\xD2\xC9=\xF3\xD3\xCAYf\b\u0002\xADAX\xE4\x89G\f\xEEdFơ\xA1\xB9c=\xBE\x8B\xF8\x8Cc\x9624\x9F.\xE9\u0018\xEC\xEB`_\xF2\xB87\xCD\xE1p\u000E\xBFY\>\xC2\xFC-\x8E~|:\xE9\x8Ah"u{\u0010u\x9B\rԡk784w\u0013R\u0019U\xE8x\xD8\xDD:.\u001F\xB9\e\xCC\xC1;\xD2\u001D\u000F\xBB\xD7A\x8E73{8\xEC\xBEg!\xAA\xA7jm\xCA\u0002Â\x85/\xC7\xD9Ń\xC3U\xB8\xDF\xFE\v\u0000\u0000\xFF\xFF\x8A\u0013\xA3& port:52,824 \_id:xphQg2QB\_Ewnis7Rrwiy \_type:doc \_index:logstash-2018.07.10 \_score: - Any clue? ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 10, 2018, 2:14pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/2 "2018-07-10T14:14:21Z")
hello? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 10, 2018, 2:39pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/3 "2018-07-10T14:39:44Z")
What's the origin of this message? Looks like something from a binary protocol that hasn't been decoded. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 10, 2018, 2:41pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/4 "2018-07-10T14:41:10Z")
> hello? Yes? If you're trying to annoy people you're on the right track. ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 10, 2018, 2:45pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/5 "2018-07-10T14:45:42Z")
Going to ignore your last message because it was uncalled for. This is from a log output in Kibana: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/9/491e9d39057044f1e41bc3d01e6635e150d95599.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 10, 2018, 4:59pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/6 "2018-07-10T16:59:36Z")
> Going to ignore your last message because it was uncalled for. It was snarky, yes, but pinging threads after just a couple of hours is also uncalled for. > This is from a log output in Kibana: Please answer my previous question. How does this piece of data end up in Logstash? Via the network it seems, but what's on the other end? ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 12, 2018, 8:35am UTC](https://discuss.elastic.co/t/weird-log-output/139312/7 "2018-07-12T08:35:21Z")
> [@magnusbaeck](#): > > my previous question. How does this piece of data end up in Logsta its my linux server. I have ELK and beats installed on my Linux server and am accessing Kibana via the web ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 12, 2018, 9:16am UTC](https://discuss.elastic.co/t/weird-log-output/139312/8 "2018-07-12T09:16:04Z")
Okay. And what does your Logstash pipeline configuration look like? ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 13, 2018, 10:01am UTC](https://discuss.elastic.co/t/weird-log-output/139312/9 "2018-07-13T10:01:12Z")
Quite simple: - pipeline.id: mypipeline\_1 path.config: "/etc/logstash/conf.d/\*.conf" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 13, 2018, 11:33am UTC](https://discuss.elastic.co/t/weird-log-output/139312/10 "2018-07-13T11:33:18Z")
But what's in /etc/logstash/conf.d/\*.conf? ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 13, 2018, 12:16pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/11 "2018-07-13T12:16:25Z")
These configs- Logstash-Beats.conf: ``` input { beats { port => 5044 } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } ``` Logstash-Apache.conf ``` input { file { path => "/var/log/logstash/*_log" } } filter { if [path] =~ "access" { mutate { replace => { type => "apache_access" } } grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } } else if [path] =~ "error" { mutate { replace => { type => "apache_error" } } } else { mutate { replace => { type => "random_logs" } } } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } ``` Logstash-syslog.conf ``` input { tcp { port => 5000 type => syslog } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } ``` demo-metrics-pipeline.conf ``` input { beats { port => 5044 } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } ``` Logstash-simple.conf ``` input { stdin { } } filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 13, 2018, 2:33pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/12 "2018-07-13T14:33:50Z")
So which of these inputs is setting `type` to "random\_logs" and `port` to 33378? Are you sure there isn't an extra tcp or udp input somewhere? Or is it the beats input, receiving data from Filebeat that's reading a .gz file or something? You'll have to do some debugging on your end. Side note: These configuration files are almost certainly incorrect and missing lots of conditionals to prevent events from one file to "leak" into the outputs defined in another file. None of that is responsible for the problem you're asking about though. ---
**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Post date:** [July 13, 2018, 2:54pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/13 "2018-07-13T14:54:02Z")
Yeah, I got the files configurations from the documentation. It does state that's a simple/standard configuration. On the syslog config there's a TCP and there was also a UDP but I deleted. > "Or is it the beats input, receiving data from Filebeat that's reading a .gz file or something?" How can I check this? im fairly new to this Funny thing is with Winlogbeat I get logs just fine, they are readable. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 13, 2018, 4:09pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/14 "2018-07-13T16:09:07Z")
> [@Marcos\_Felix](#): > > pipeline.id: mypipeline\_1 > path.config: "/etc/logstash/conf.d/\*.conf" I don't think you understand what this does. It concatenates all those configuration files and creates one pipeline to run that configuration. That means that events from your beats input go through your logstash-Apache.conf filter, where they will get type set to random\_logs, and then through your logstash-simple.conf, which will add a \_grokparsefailure tag. That means you should have 3 copies of each event in your logstash indexes and another two in your beats indexes. As Magnus implied, you need all this processing to be conditional, as you have done in logstash-syslog.conf. Alternatively, run each configuration in its own pipeline. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 13, 2018, 8:40pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/15 "2018-07-13T20:40:52Z")
> How can I check this? im fairly new to this Start by commenting out pieces of the configuration to narrow down which input is causing these messages. If it turns out to be the beats input, look into which beats clients are sending messages and narrow it down to a single client. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 10, 2018, 8:41pm UTC](https://discuss.elastic.co/t/weird-log-output/139312/16 "2018-08-10T20:41:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.