# How to collect data in character special device like /dev/kmsg?
**URL:** https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801
**Category:** Beats
**Tags:** filebeat
**Created:** [May 8, 2023, 9:58am UTC](https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801 "2023-05-08T09:58:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@linrl3](https://discuss.elastic.co/u/linrl3)
#### Post date: [May 8, 2023, 9:58am UTC](https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801/1 "2023-05-08T09:58:50Z")
Like the title said, how can I use filebeat to collect from character device, for example /dev/kmsg.
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [May 8, 2023, 4:07pm UTC](https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801/2 "2023-05-08T16:07:13Z")
Hey @linrl3, welcome to discuss 🙂
Filebeat is not able to collect logs from character devices. Its filestream input is only able to collect logs from regular files. It also expects to be able to make `seek` operations, what is not allowed in character devices.
Though, I have done a quick test removing the `seek`s, and the code that checks if the file is a regular one, and it became able of collecting from `/dev/kmsg`.
So maybe Filebeat could have an option, or input, to allow collecting information from character devices. Taking into account that, without `seek`, it may collect repeated information if restarted.
Feel free to [open an issue](https://github.com/elastic/beats/issues/new?assignees=&labels=&template=feature-request.md) requesting that.
FTR, this is the patch I used to remove the `seek`s.
```auto
diff --git a/filebeat/input/filestream/filestream.go b/filebeat/input/filestream/filestream.go
index 0dce4b772d..4f558df6ad 100644
--- a/filebeat/input/filestream/filestream.go
+++ b/filebeat/input/filestream/filestream.go
@@ -67,11 +67,6 @@ func newFileReader(
config readerConfig,
closerConfig closerConfig,
) (*logFile, error) {
- offset, err := f.Seek(0, os.SEEK_CUR)
- if err != nil {
- return nil, err
- }
-
readerCtx := ctxtool.WithCancelContext(ctxtool.FromCanceller(canceler))
tg := unison.TaskGroupWithCancel(readerCtx)
@@ -84,7 +79,6 @@ func newFileReader(
closeInactive: closerConfig.OnStateChange.Inactive,
closeRemoved: closerConfig.OnStateChange.Removed,
closeRenamed: closerConfig.OnStateChange.Renamed,
- offset: offset,
lastTimeRead: time.Now(),
backoff: backoff.NewExpBackoff(canceler.Done(), config.Backoff.Init, config.Backoff.Max),
readerCtx: readerCtx,
diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go
index 2bd53c0e4d..febb963db1 100644
--- a/filebeat/input/filestream/input.go
+++ b/filebeat/input/filestream/input.go
@@ -286,22 +286,12 @@ func (inp *filestream) openFile(log *logp.Logger, path string, offset int64) (*o
}
func checkFileBeforeOpening(fi os.FileInfo) error {
- if !fi.Mode().IsRegular() {
- return fmt.Errorf("tried to open non regular file: %q %s", fi.Mode(), fi.Name())
- }
return nil
}
func (inp *filestream) initFileOffset(file *os.File, offset int64) error {
- if offset > 0 {
- _, err := file.Seek(offset, io.SeekCurrent)
- return err
- }
-
- // get offset from file in case of encoding factory was required to read some data.
- _, err := file.Seek(0, io.SeekCurrent)
- return err
+ return nil
}
```
---
### Author:  [@linrl3](https://discuss.elastic.co/u/linrl3)
#### Post date: [May 9, 2023, 2:35am UTC](https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801/3 "2023-05-09T02:35:47Z")
Thank you @jsoriano ! I will try this code on my side.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2023, 4:35am UTC](https://discuss.elastic.co/t/how-to-collect-data-in-character-special-device-like-dev-kmsg/332801/4 "2023-06-06T04:35:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.