# Filebeat - Single line log without newline character

**URL:** <https://discuss.elastic.co/t/filebeat-single-line-log-without-newline-character/327157>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 7, 2023, 8:45am UTC](https://discuss.elastic.co/t/filebeat-single-line-log-without-newline-character/327157 "2023-03-07T08:45:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![True](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/true/32/100813_2.png) [@True](https://discuss.elastic.co/u/True)\
**Post date:** [March 7, 2023, 8:45am UTC](https://discuss.elastic.co/t/filebeat-single-line-log-without-newline-character/327157/1 "2023-03-07T08:45:51Z")

</div>

Hello 🥲

Is there any possible method for shipping single-line logs **without newline characters** from Filebeat to Kafka?  
I'm using 8.6.1 Stack, and in Filebeat, filestream (log) type.  
The log is created just once every day.  
And the setting (no newline) is strict, I can't change or modify it.

After reading this log, there is no error log left.  
Harvester is working nomaly (pipeline open, close, etc..), but not shipping to Kafka.  
I think Filebeat should wait the next log, even if the log is already ended, because there is no newline character.  
cf) [elasticGuide\_filebeat\_newlineCharacterRequired](https://www.elastic.co/guide/en/beats/filebeat/current/newline-character-required-eof.html)

If add the log newline character on purpose, it works well.  
In that case, Kafka got all of the log line without leak.  
So it's not problem with log size, lang or any other setting...  
But I can't suggest adding newline character in the log to related department, I really need help to through this problem.

I tried some tricks for that.

1. 'close' option - Using filestream type (and log type either)  
I tried harvester close with all option (timeout, rename, removed, eof...).  
But none of them works for me. Maybe 'close' means a real 'close'. Not 'shipping before close'.

2. 'multiline' and 'mutiline timeout' option  
I write a pattern '\*' and set multiline timeout.  
The result is the same as above.

Any solutions of this? 🥲 🥲 🥲

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2023, 10:46am UTC](https://discuss.elastic.co/t/filebeat-single-line-log-without-newline-character/327157/2 "2023-04-04T10:46:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.