# Delimiter for FILEBEAT?

**URL:** <https://discuss.elastic.co/t/delimiter-for-filebeat/92074>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 6, 2017, 10:01am UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074 "2017-07-06T10:01:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahongyun](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@ahongyun](https://discuss.elastic.co/u/ahongyun)\
**Post date:** [July 6, 2017, 10:01am UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/1 "2017-07-06T10:01:40Z")

</div>

I have been using logstash to ship logs using the following config

```
  	file {
		path => "/appdir/logs/*\.log\.xml"
		type => "log.xml" 
		delimiter => "</LogRoot>"

```

I am trying to shift to use Filebeat but i have issues finding a "delimiter" replacement.

Can anyone help me with this?

Thanks

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 7, 2017, 1:57pm UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/2 "2017-07-07T13:57:24Z")

</div>

in filebeat you can not configure a 'delimiter'. filebeat is splitting up logs by newline.

But you can use filebeat multiline support to match on `^</LogRoot>$`.

---

<div class="post-metadata">

**Author:** ![ahongyun](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@ahongyun](https://discuss.elastic.co/u/ahongyun)\
**Post date:** [July 13, 2017, 6:21am UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/3 "2017-07-13T06:21:27Z")

</div>

would it work if the log in question is a single line ?

`<LogRoot><LogMessage Date="Wed Apr 12 19:36:28 SGT 2017" Count="1" Type="Text" Level="Information"/><LogMessage Date="Wed Apr 12 19:36:36 SGT 2017" Count="2" Type="Text">Session MXPROCESSINGSCRIPT_POOL_A created, PID=104506, NPID=39314, InstallationCode=mxprocessingscript_s01smxu10z1a, nickName=MXPROCESSINGSCRIPT_POOL_A, host=s01smxu10z1a</LogMessage><LogMessage Date="Wed Apr 12 19:37:16 SGT 2017" Count="3" Type="Tree" Level="Information"/><GuiRoot><batch execution="synchronous"><label>BEXT_AUDINSRMSE</label><getJobDetailsResponse><jobID>2239574</jobID><user>BATCHUSER</user><group>MO_EOD_A</group><status>Done</status><date>12/04/17</date><time>19:37:05</time><endTime>19:37:16</endTime><details><element index="0"><label>EXT_AUDINSRMSPM</label></element></details></getJobDetailsResponse></batch></GuiRoot><LogMessage Date="Wed Apr 12 19:37:17 SGT 2017" Count="4" Type="Text" Level="Information"/></LogRoot>`

if it doesnt, what would you suggest in this case?

since its a single line, the harvester is open but doesnt send anything to logstash.  
In addition, this log file is updated over time : meaning that values are changed within the log file.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 13, 2017, 5:45pm UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/4 "2017-07-13T17:45:32Z")

</div>

questions:

- is the log entry always a single line?
- do you have multiple entries in a log file?
- does the line end with a newline character?

---

<div class="post-metadata">

**Author:** ![ahongyun](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@ahongyun](https://discuss.elastic.co/u/ahongyun)\
**Post date:** [July 14, 2017, 2:39am UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/5 "2017-07-14T02:39:53Z")

</div>

yes the log entry is always a single line  
there is only a single entry in each log file  
it does not end with a new line character

thanks ^^

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 14, 2017, 2:56pm UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/6 "2017-07-14T14:56:31Z")

</div>

filebeat splits lines on newline characters. The splitting pattern is not yet configurable. Feel free to open a feature request on: [https://github.com/elastic/beats/issues](https://github.com/elastic/beats/issues)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 2:56pm UTC](https://discuss.elastic.co/t/delimiter-for-filebeat/92074/7 "2017-08-11T14:56:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.