# FileBeat and Sidecar: who trim the message?
**URL:** https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728
**Category:** Graylog Central (peer support)
**Tags:** sidecar
**Created:** [October 10, 2017, 3:57pm UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728 "2017-10-10T15:57:15Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)
#### Post date: [October 10, 2017, 3:57pm UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/1 "2017-10-10T15:57:16Z")
Hi,
I’d like to share with you this strange (for me) filebeat behaviour.
I’m using filebeat to read a log file (MySql generic log).
this is an extract of the log file:
```
171009 14:04:26 7 Connect root@10.10.100.53 on
7 Query select @@version_comment limit 1
171009 14:06:26 7 Connect root@10.10.100.55 on
```
Splitting the message using \t we can parse the message.
The strange situation is that on graylog the massage value that I can use and parse is **trimmed**
The empty spaces are missing! Why?
So, can somebody explain me what happen? Who trim the message?
Is this the correct behaviour?
Thanks
Gianluca
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 10, 2017, 4:08pm UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/2 "2017-10-10T16:08:59Z")
What’s your Filebeat Configuration?
---
### Author:  [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)
#### Post date: [October 10, 2017, 8:10pm UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/3 "2017-10-10T20:10:03Z")
Hi @jochen
this is my filebeat.yml
```
filebeat:
prospectors:
- encoding: UTF-8
fields:
collector_node_id: graylog-collector-sidecar
gl2_source_collector: 6439f440-9cd8-4793-948e-ff3937d73d45
source_name: DBMS
type: log
ignore_older: 0
paths:
- /var/lib/mysql/mysql-mock.log
scan_frequency: 10s
tail_files: true
type: log
output:
logstash:
hosts:
- 10.10.100.211:5047
path:
data: /var/cache/graylog/collector-sidecar/filebeat/data
logs: /var/log/graylog/collector-sidecar
tags:
- mysqlmock
```
that comes from this Graylog collectors configurations:
Do you think that there could be a misconfiguration?
Thanks
Gianluca
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 11, 2017, 6:46am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/4 "2017-10-11T06:46:02Z")
> [@gianluca-valentini](#):
>
> Who trim the message?
>
> Is this the correct behaviour?
Graylog trims string values in messages automatically:
>
---
### Author:  [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)
#### Post date: [October 11, 2017, 7:52am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/5 "2017-10-11T07:52:56Z")
Ok thanks.
But I don’t understand why the messagge is trimmed.
How you can manage a message that comes from a positional log?
In my case, but there are others example like SAP log, the position is as important as the presence of white spaces in the row.
So how I could resolve my problem? Is possible to find a workaround?
Gianluca
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 11, 2017, 8:22am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/6 "2017-10-11T08:22:02Z")
I think you probably want to merge the two log lines instead of having them as separate messages in Graylog.
You can use the multiline feature (see the Graylog Collector Sidecar configuration) for this.
---
### Author:  [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)
#### Post date: [October 11, 2017, 8:43am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/7 "2017-10-11T08:43:42Z")
Hi @jochen
I’m reading the MySql general query log (tha is a general record of what mysq is doing)
So each row is different from the others and could be not related with the before one.
I don’t know if merging the timestamp could be a solution even if it is intuitively correct.
Can you explain me how does the multiline features works? Can you give me an example please?
For example, the MySql file ends with the SQL command executed and sometimes it can be null
`171011 10:09:11 11 Quit`
Is the the possibility that the multiline adding something different then the ‘null’ sql command (that is the correct value)?
Thanks
Gianluca
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 11, 2017, 8:58am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/8 "2017-10-11T08:58:25Z")
> [@gianluca-valentini](#):
>
> Can you explain me how does the multiline features works? Can you give me an example please?
Please refer to [Managing Multiline Messages | Filebeat Reference [5.6] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/5.6/multiline-examples.html)
---
### Author:  [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)
#### Post date: [October 11, 2017, 8:59am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/9 "2017-10-11T08:59:49Z")
Thanks a lot.
I will take a look to your suggested link
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [October 25, 2017, 9:00am UTC](https://community.graylog.org/t/filebeat-and-sidecar-who-trim-the-message/2728/10 "2017-10-25T09:00:06Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.