# Filebeat send ' \\u0000 ' and the event loss and the new line append to the last line

**URL:** <https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 8, 2022, 9:03am UTC](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972 "2022-09-08T09:03:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![codeyoungth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codeyoungth/32/110644_2.png) [@codeyoungth](https://discuss.elastic.co/u/codeyoungth)\
**Post date:** [September 8, 2022, 9:03am UTC](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972/1 "2022-09-08T09:03:27Z")

</div>

my config is as follow:

```auto
      filebeat.inputs:
        - type: filestream
          enabled: true
          id: filebeat-input-log
          paths:
            - /app/log/*/*.log
          parsers:
            - multiline:
                type: pattern
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
                negate: true
                match: after
                max_lines: 100000
                timeout: 20s
          exclude_lines: ['^[0-9]{4}-[0-9]{2}-[0-9]{2}\s*.*?\s*--(\s|\s(-|v+|\^+))$']
          close.on_state_change.inactive: 6h
          close.on_state_change.renamed: true
          ignore_older: 24h
      processors:
        - add_id: ~
        - drop_fields:
            fields: ["ages", "ls", "ht"]
      output.logstash:
        hosts: ["logstash:5044"]

```

filebeat version: 7.16.2 (amd64)  
server: linux  
desription:  
some '\u0000' was produced after filebeat harvested where the log was loss and the new line append to the last line .

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/2/621ea38f8274bdd72c816c7c9212bdc129d98250.png)

as the picture shows in the end ,'2022-09-08' should be the beginning of a new line but it append to the end of �.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2022, 11:03am UTC](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972/2 "2022-10-06T11:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.