# Log stash is not reading last record in a file

**URL:** https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979
**Category:** Logstash
**Created:** [February 26, 2019, 10:50am UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979 "2019-02-26T10:50:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Mayurbiw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayurbiw/32/45858_2.png) [@Mayurbiw](https://discuss.elastic.co/u/Mayurbiw)
#### Post date: [February 26, 2019, 10:50am UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979/1 "2019-02-26T10:50:44Z")

</div>

I am reading an audit file using log stash. The problem is log stash doesn't read the last record in a file let's call that record X. when I push another record in a file let's call it Y. it reads the X and presents it in output but it doesn't show Y in the output. This goes on. When I stop the log stash it then reads the last record in a file and shows it in output.

I need some suggestion or solutions to solve this issue.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 26, 2019, 12:36pm UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979/2 "2019-02-26T12:36:41Z")

</div>

Are you using a multiline codec?

---

<div class="post-metadata">

### Author: ![Mayurbiw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayurbiw/32/45858_2.png) [@Mayurbiw](https://discuss.elastic.co/u/Mayurbiw)
#### Post date: [February 27, 2019, 8:50am UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979/3 "2019-02-27T08:50:42Z")

</div>

Yes I am using it.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 27, 2019, 10:20am UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979/4 "2019-02-27T10:20:17Z")

</div>

Using the auto\_flush\_interval option might help. A multiline codec will not push an event until it has a complete event, for some configurations that means it needs to see the first line of the next event before it can push the previous event into the pipeline.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2019, 10:20am UTC](https://discuss.elastic.co/t/log-stash-is-not-reading-last-record-in-a-file/169979/5 "2019-03-27T10:20:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
