Legacy software I have to use works on Windows and writes a log in the following way:
it writes a lot of \u0000 (NULL) symbols into the end of file to preallocate space and then (when it needs to write a log string) consistently replaces NULLs with real data.
But Filebeat reads NULLs immediately when they appear and sends them to Logstash. Thereby Logstash receives a lot of garbage and most of the real logs are not sent at all.
Is there any solution of this issue?
I've found some topics about \u0000 and buffering like this:
But there is no solution.