Logstash file: how to read first line only

Hi evreyone.
I wanted to know if it's possible to read only the first line of a file and exit (after send information to elastisearch)
Thanks in advance

pls show your first line...
so that we can see it contain what ?

Thanks for your reply Kurnal

The first line of my file would be:

ÿØÿà JFIF ÿÛ C a

(it's a binary file you can't read it)

I' not interested in the content itself but in the place where the file is located (path). I want take only the first line and exit because if i read all lines logstash give an encoding error

 Received an event that has a different character encoding than you configured.{:text=>"\\v\\u0011\\f\\r\\f\\r\\f\\u0011\\u001A\\u0010\\u0013\\u0010\\u0010\\u0013\\u0010\\u001A\\u0017\\e\\u0016\\u0015\\u0016\\e\\u0017) \\u001C\\u001C )/'%'/9339GDG]]}\\xFF\\xC2\\u0000\\v\\b\\u0001h\\u0001h\\u0001\\u0001!\\u0000\\xFF\\xC4\\u0000\\u001D\\u0000\\u0001\\u0000\\u0002\\u0002\\u0003\\u0001\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0005\\u0002\\b\\u0003\\a\\t\\u0006\\u0001\\xFF\\xDA\\u0000\\b\\u0001\\u0001\\u0000\\u0000\\u0000\\u0000\\xDB\\u0002\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001A`YIcLYIcLYIcLYIcLYIcLYIcL\\v),i\\x8B),i\\x8B),i\\x8B),i\\x8B),i\\x8B),i\\x8B\\u0013\\f\\xD8\\xE4a\\x9B\\u001C\\x8C3c\\x91\\x86lr0͎F\\u0019\\xB1ȔWEr\\xDB\\u0015\\xD1\\\\\\xB6\\xC5tW-\\xB1]\\u0015\\xCBlWEr\\xDB\\u0015\\xD1\\\\\\xB6\\xC0\\xAE\\x8A\\xE5\\xB6)\\xFE\\u0005\\xC9j@\\x8A\\xE4\\xB5 ErZ\\xFD5\\xBDtW-\\xB1]\\u0015\\xCBl"
  :expected_charset=>"UTF-8"}

I have tried to change the encoding but it didn't work.

you can put if condition, if it fulfill then put that lin in msg and afterward you can retrieve data which you want from message or u can use regex...

Thanks @Krunal for your reply.
You mean to take the first value and get out of the file?

yes...take value and drop the other data...
it will be easy i think..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.