# Last line of log not picked up by logstash

**URL:** https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286
**Category:** Logstash
**Created:** [August 1, 2017, 6:58am UTC](https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286 "2017-08-01T06:58:19Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)
#### Post date: [August 1, 2017, 6:58am UTC](https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286/1 "2017-08-01T06:58:20Z")

</div>

Hi

I am using logstash version 5 and trying to parse a log file.

When there are 10 records in the log file, logstash processes only 9. Not picking up the last line of the log.

I picked the last record and tried to parse it on test grok patterns and it worked fine.

I also copy pasted the record again in the log and it was successfully picked up by the logstash.

But I am not able to solve out the issue that if we have multiple lines of log then why logstash is not picking up the last line.

Here is my logstash configuration file:

```
input {

```

beats {  
port =\> 5044  
}  
}

filter {  
grok {  
match =\> { "message" =\> ["iDoc\_nbr:%{USERNAME:idoc\_number}|status:%{GREEDYDATA:log\_message}|error\_code:%{USERNAME:error\_code}|error\_msg:%{GREEDYDATA:error\_message}|error\_desc:%{GREEDYDATA:error\_description}"  
] }  
}

```
mutate {
  add_field => { "tech_stack" => "%{[fields][tech_stack]}" }
  add_field => { "kpi_type" => "%{[fields][kpi_type]}" }
}

```

}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
user =\> "elastic"  
password =\> "changeme"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
stdout { codec =\> rubydebug }  
}

Please help.

---

<div class="post-metadata">

### Author: ![abhiroyg](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)
#### Post date: [August 1, 2017, 7:01am UTC](https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286/2 "2017-08-01T07:01:18Z")

</div>

Please have a look at this:  
[https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#newline-character-required-eof](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#newline-character-required-eof)

---

<div class="post-metadata">

### Author: ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)
#### Post date: [August 1, 2017, 7:24am UTC](https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286/3 "2017-08-01T07:24:59Z")

</div>

Thanks a lot for your help. My problem is solved now.

Actually I was not pressing enter key after last line of the log. So it was not picking up the last line.

Once I pressed enter key at the end of last line of log, the record was picked up.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2017, 7:25am UTC](https://discuss.elastic.co/t/last-line-of-log-not-picked-up-by-logstash/95286/4 "2017-08-29T07:25:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
