# FortiMail logs are being combined in TCP input **URL:** \ **Category:** Logstash\ **Created:** [April 11, 2023, 5:51pm UTC](https://discuss.elastic.co/t/fortimail-logs-are-being-combined-in-tcp-input/329768 "2023-04-11T17:51:47Z")\ **Posts on this page:** 1\ **Showing post:** 5
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 11, 2023, 7:12pm UTC](https://discuss.elastic.co/t/fortimail-logs-are-being-combined-in-tcp-input/329768/5 "2023-04-11T19:12:53Z")
I suspect that the problem is FortiMail is sending RFC 5425 compliant "octet-counted" messages (i.e. no trailing newline). See [this](https://discuss.elastic.co/t/logstash-compliance-with-rfc5425-and-rfc5426/327243/3) thread for a little more detail. Not sure if FortiMail can be configured to use traditional format instead of RFC 5425. The existing tcp input is line-oriented, but you need a byte-oriented input. The difference between the two creates issues that were [long ago recognized](https://github.com/elastic/logstash/issues/5124). (Note that the issue is still open, none of the re-architecture that was envisioned actually happened.) You could re-write the tcp input to be byte oriented, but it would be much simpler to add a syslog server that can read RFC 5425 compliant messages from FortiMail and forward them to logstash in traditional newline separated format. > [@6igwig](#): > > ``` > :message=>"Illegal quoting in line 1.", :data=>"437 <6>date=2023-04-10,time=16:52:07.587,device_id=xxx,log_id=123,type=event,subtype=smtp,pri=information, user=mail,ui=mail,action=NONE,status=N/A,session_id=\"33AKq7LU018089-33AKq7LX018089\", > > ``` Your problem here is that if a CSV field contains double quotes then the entire field must be quoted. So instead of ``` session_id="33AKq7LU018089-33AKq7LX018089" ``` it would have to be ``` "session_id=""33AKq7LU018089-33AKq7LX018089""" ``` --- _[View the full topic](https://discuss.elastic.co/t/fortimail-logs-are-being-combined-in-tcp-input/329768)._