# Harvest only till last but one line?

**URL:** <https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988 "2022-04-22T07:15:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbml](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@gbml](https://discuss.elastic.co/u/gbml)\
**Post date:** [April 22, 2022, 7:15am UTC](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988/1 "2022-04-22T07:15:59Z")

</div>

Hello.  
Im trying to ship logs via filebeat 8.1.2  
I have an app that generate text log, but in strange manner:  
After first event log file look like this:

```auto
Line 1\n
(space_symgol_1)(space_symgol_2)...(space_symgol_1_000_000)

```

After next event it look like this:

```auto
Line 1\n
Line 2 (100 symbols)\n
(space_symgol_1)(space_symgol_2)...(space_symgol_999_900)

```

In other words app reserve space and use it for inserting new data.  
I see this spaces in notepad. Under the hood, i guess, it is amount of NULL.  
This behavior causes harvester to stop reading new lines. I get lines only till filebeat start time.  
I’ve tried using close\_timeout: 30s. It almost worked, but at midnight app delete these spaces and filebeat read the file again, and logs are duplicated.  
Is there a way to harvest only till last but one line?  
Any help will be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2022, 9:16am UTC](https://discuss.elastic.co/t/harvest-only-till-last-but-one-line/302988/2 "2022-05-20T09:16:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.