# Filebeat не читает последнюю строку файла

**URL:** <https://discuss.elastic.co/t/filebeat/287500>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 23, 2021, 8:03pm UTC](https://discuss.elastic.co/t/filebeat/287500 "2021-10-23T20:03:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![IVHN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ivhn/32/96289_2.png) [@IVHN](https://discuss.elastic.co/u/IVHN)\
**Post date:** [October 23, 2021, 8:03pm UTC](https://discuss.elastic.co/t/filebeat/287500/1 "2021-10-23T20:03:39Z")

</div>

Добрый день.  
Столкнулся со следующей проблемой - filebeat не читает последнюю строку файла.  
Вот, например, есть файлик (input.log) со следующим содержимым

```auto
{7,1560,2},
{7,1562,3},
{7,1564,4},
{7,1565,5},
{7,1571,6}

```

Filebeat читает только первые 4 строки, т.е последняя прочитанная строка - {7,1565,5}.  
После добавления записи в файл он приобретает следующий вид

```auto
{7,1560,2},
{7,1562,3},
{7,1564,4},
{7,1565,5},
{7,1571,6},
{7,1580,7}

```

Тогда filebeaat опять вычитывает только предпоследнюю строку - {7,1571,6},

Пробовал различные вариации multiline pattern, без него, исход один и тот же.

Текущая конфигурация (файл filebeat.yml, для теста):

```auto
output.file:
  path: "/tmp"
  filename: debug.txt
filebeat.inputs:
  - type: filestream
    enabled: true
    paths:
      - C:\ELK\input_test\input.log     
    fields:
      log_type: all
      log_timezone: Europe/Moscow
      tags: ["eventlog_vcbl"]

```

Для примера, что пишет в debug.txt (результат обработки первого примера).

```auto
{"@timestamp":"2021-10-23T19:57:44.451Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.15.1"},"input":{"type":"filestream"},"fields":{"log_timezone":"Europe/Moscow","tags":["eventlog_vcbl"],"log_type":"all"},"ecs":{"version":"1.11.0"},"host":{"name":"erp-dev"},"agent":{"name":"erp-dev","type":"filebeat","version":"7.15.1","hostname":"erp-dev","ephemeral_id":"22cca3cc-29a4-4d98-b11a-1fbd1196cc2d","id":"f9f9b509-27f1-4bbb-bdef-7e4f975aa5e0"},"message":"{7,1560,2},","log":{"offset":16,"file":{"path":"C:\\ELK\\input_test\\input.log"}}}
{"@timestamp":"2021-10-23T19:57:44.451Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.15.1"},"log":{"offset":29,"file":{"path":"C:\\ELK\\input_test\\input.log"}},"message":"{7,1562,3},","fields":{"tags":["eventlog_vcbl"],"log_type":"all","log_timezone":"Europe/Moscow"},"input":{"type":"filestream"},"ecs":{"version":"1.11.0"},"host":{"name":"erp-dev"},"agent":{"name":"erp-dev","type":"filebeat","version":"7.15.1","hostname":"erp-dev","ephemeral_id":"22cca3cc-29a4-4d98-b11a-1fbd1196cc2d","id":"f9f9b509-27f1-4bbb-bdef-7e4f975aa5e0"}}
{"@timestamp":"2021-10-23T19:57:44.451Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.15.1"},"log":{"file":{"path":"C:\\ELK\\input_test\\input.log"},"offset":42},"message":"{7,1564,4},","input":{"type":"filestream"},"fields":{"tags":["eventlog_vcbl"],"log_type":"all","log_timezone":"Europe/Moscow"},"ecs":{"version":"1.11.0"},"host":{"name":"erp-dev"},"agent":{"id":"f9f9b509-27f1-4bbb-bdef-7e4f975aa5e0","name":"erp-dev","type":"filebeat","version":"7.15.1","hostname":"erp-dev","ephemeral_id":"22cca3cc-29a4-4d98-b11a-1fbd1196cc2d"}}
{"@timestamp":"2021-10-23T19:57:44.451Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.15.1"},"agent":{"ephemeral_id":"22cca3cc-29a4-4d98-b11a-1fbd1196cc2d","id":"f9f9b509-27f1-4bbb-bdef-7e4f975aa5e0","name":"erp-dev","type":"filebeat","version":"7.15.1","hostname":"erp-dev"},"log":{"offset":55,"file":{"path":"C:\\ELK\\input_test\\input.log"}},"message":"{7,1565,5},","input":{"type":"filestream"},"fields":{"tags":["eventlog_vcbl"],"log_type":"all","log_timezone":"Europe/Moscow"},"ecs":{"version":"1.11.0"},"host":{"name":"erp-dev"}}

```

Очень нужна последняя строка, проблему дублирования данных я решу на уровне приёмника (logstash). Версия filebeat 7.15.1

Помогите, пожалуйста.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2021, 10:03pm UTC](https://discuss.elastic.co/t/filebeat/287500/2 "2021-11-20T22:03:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.