Harvest only till last but one line?

Im trying to ship logs via filebeat 8.1.2
I have an app that generate text log, but in strange manner:
After first event log file look like this:

Line 1\n

After next event it look like this:

Line 1\n
Line 2 (100 symbols)\n

In other words app reserve space and use it for inserting new data.
I see this spaces in notepad. Under the hood, i guess, it is amount of NULL.
This behavior causes harvester to stop reading new lines. I get lines only till filebeat start time.
I’ve tried using close_timeout: 30s. It almost worked, but at midnight app delete these spaces and filebeat read the file again, and logs are duplicated.
Is there a way to harvest only till last but one line?
Any help will be appreciated.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.