# Logstash file: how to read first line only

**URL:** <https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122>\
**Category:** Logstash\
**Created:** [June 16, 2021, 10:19am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122 "2021-06-16T10:19:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Betorov](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Post date:** [June 16, 2021, 10:19am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/1 "2021-06-16T10:19:48Z")

</div>

Hi evreyone.  
I wanted to know if it's possible to read only the first line of a file and exit (after send information to elastisearch)  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![Krunal](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Krunal](https://discuss.elastic.co/u/Krunal)\
**Post date:** [June 16, 2021, 12:13pm UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/2 "2021-06-16T12:13:35Z")

</div>

pls show your first line...  
so that we can see it contain what ?

---

<div class="post-metadata">

**Author:** ![Betorov](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Post date:** [June 16, 2021, 12:36pm UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/3 "2021-06-16T12:36:47Z")

</div>

Thanks for your reply Kurnal

The first line of my file would be:

ÿØÿà JFIF ÿÛ C a

(it's a binary file you can't read it)

I' not interested in the content itself but in the place where the file is located (path). I want take only the first line and exit because if i read all lines logstash give an encoding error

```auto
 Received an event that has a different character encoding than you configured.{:text=>"\\v\\u0011\\f\\r\\f\\r\\f\\u0011\\u001A\\u0010\\u0013\\u0010\\u0010\\u0013\\u0010\\u001A\\u0017\\e\\u0016\\u0015\\u0016\\e\\u0017) \\u001C\\u001C )/'%'/9339GDG]]}\\xFF\\xC2\\u0000\\v\\b\\u0001h\\u0001h\\u0001\\u0001!\\u0000\\xFF\\xC4\\u0000\\u001D\\u0000\\u0001\\u0000\\u0002\\u0002\\u0003\\u0001\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0004\\u0005\\u0002\\b\\u0003\\a\\t\\u0006\\u0001\\xFF\\xDA\\u0000\\b\\u0001\\u0001\\u0000\\u0000\\u0000\\u0000\\xDB\\u0002\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001Ab\\xCAK\\u001A`YIcLYIcLYIcLYIcLYIcLYIcL\\v),i\\x8B),i\\x8B),i\\x8B),i\\x8B),i\\x8B),i\\x8B\\u0013\\f\\xD8\\xE4a\\x9B\\u001C\\x8C3c\\x91\\x86lr0͎F\\u0019\\xB1ȔWEr\\xDB\\u0015\\xD1\\\\\\xB6\\xC5tW-\\xB1]\\u0015\\xCBlWEr\\xDB\\u0015\\xD1\\\\\\xB6\\xC0\\xAE\\x8A\\xE5\\xB6)\\xFE\\u0005\\xC9j@\\x8A\\xE4\\xB5 ErZ\\xFD5\\xBDtW-\\xB1]\\u0015\\xCBl"
  :expected_charset=>"UTF-8"}

```

I have tried to change the encoding but it didn't work.

---

<div class="post-metadata">

**Author:** ![Krunal](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Krunal](https://discuss.elastic.co/u/Krunal)\
**Post date:** [June 24, 2021, 7:20am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/4 "2021-06-24T07:20:10Z")

</div>

you can put if condition, if it fulfill then put that lin in msg and afterward you can retrieve data which you want from message or u can use regex...

---

<div class="post-metadata">

**Author:** ![Betorov](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Post date:** [June 24, 2021, 7:24am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/5 "2021-06-24T07:24:48Z")

</div>

Thanks @Krunal for your reply.  
You mean to take the first value and get out of the file?

---

<div class="post-metadata">

**Author:** ![Krunal](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Krunal](https://discuss.elastic.co/u/Krunal)\
**Post date:** [June 24, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/6 "2021-06-24T07:25:53Z")

</div>

yes...take value and drop the other data...  
it will be easy i think..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2021, 7:26am UTC](https://discuss.elastic.co/t/logstash-file-how-to-read-first-line-only/276122/7 "2021-07-22T07:26:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.