I’d like to share with you this strange (for me) filebeat behaviour.
I’m using filebeat to read a log file (MySql generic log).
this is an extract of the log file:
171009 14:04:26 7 Connect firstname.lastname@example.org on 7 Query select @@version_comment limit 1 171009 14:06:26 7 Connect email@example.com on
Splitting the message using \t we can parse the message.
The strange situation is that on graylog the massage value that I can use and parse is trimmed
The empty spaces are missing! Why?
So, can somebody explain me what happen? Who trim the message?
Is this the correct behaviour?