# Entire File as "one line"

**URL:** https://discuss.elastic.co/t/entire-file-as-one-line/197192
**Category:** Logstash
**Created:** [August 28, 2019, 7:05pm UTC](https://discuss.elastic.co/t/entire-file-as-one-line/197192 "2019-08-28T19:05:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![paiz1556](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@paiz1556](https://discuss.elastic.co/u/paiz1556)
#### Post date: [August 28, 2019, 7:05pm UTC](https://discuss.elastic.co/t/entire-file-as-one-line/197192/1 "2019-08-28T19:05:44Z")

</div>

Is there a good strategy to read an entire file as the "message" value you would send to ElasticSearch?

I see "read" mode as part of file input plugin but that wants me to write the input to a different file. I want to take what I've read and push it to Elastic Search.

I tried using the codec for multiline but didn't know how to use the end of file as the pattern.

The system i'm trying to parse writes a new file for every error so the whole file is what I need to consume. A new error, writes a new file.

Any suggestions?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 28, 2019, 7:25pm UTC](https://discuss.elastic.co/t/entire-file-as-one-line/197192/2 "2019-08-28T19:25:37Z")

</div>

Use a pattern that never matches and a timeout. I use

```
codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 }
```

---

<div class="post-metadata">

### Author: ![paiz1556](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@paiz1556](https://discuss.elastic.co/u/paiz1556)
#### Post date: [August 28, 2019, 7:47pm UTC](https://discuss.elastic.co/t/entire-file-as-one-line/197192/3 "2019-08-28T19:47:58Z")

</div>

> [@Badger](#):
>
> codec =\> multiline { pattern =\> "^Spalanzani" negate =\> true what =\> previous auto\_flush\_interval =\> 1 }

Brilliant!!! I was trying to attack it with a pattern that always matched. I also think the fact that I wasn't using the auto\_flush\_interval attribute was causing some sort of issue.

This works perfectly!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 25, 2019, 7:48pm UTC](https://discuss.elastic.co/t/entire-file-as-one-line/197192/4 "2019-09-25T19:48:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
