# Logstash not reading complete Tomcat catalina log files
**URL:** https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791
**Category:** Logstash
**Created:** [March 30, 2016, 12:57pm UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791 "2016-03-30T12:57:15Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)
#### Post date: [March 30, 2016, 12:57pm UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/1 "2016-03-30T12:57:15Z")
Hi , I have the following logstash configuration file to read catalina log files:-
input {
file {
type =\> "tomcat"
path =\> ["D:/krushnat/catalina.2016-03-16.log"]
codec =\> multiline {
negate =\> true
pattern =\> "(^%{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM))"
what =\> "previous"
}
}
}
filter {
```
if [type] == "tomcat" {
grok{
match => ["message", "%{CATALINA_DATESTAMP:timestamp} %{NOTSPACE:className} %{WORD:methodName}\r\n%{LOGLEVEL: logLevel}: %{GREEDYDATA:message}"]
overwrite => ["message"]
}
date{
match=>["timestamp","MMM dd, yyyy HH:mm:ss a"]
}
}
```
}
output {
stdout { codec=\>rubydebug }
elasticsearch{
hosts=\>"localhost"
index=\>"catalina\_logs\_20160316"
}
}
1. Every time I check kibana all the records are read except last record in each and every catalina file.
2. So I add one more record at the end of the catalina file.
3. In Kibana, now previous unread record is now read and new record which I have added is not read.
What is this behaviour of Logstash which I am failing to understand ??
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2016, 8:15pm UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/2 "2016-03-30T20:15:21Z")
Until the multiline codec sees the beginning of a new event it can't possibly know whether the current event is finished. What you can do is set the `auto_flush_interval` option to indicate how long the codec should wait before assuming that the current event is done and won't receive additional lines. The documentation is unclear on the unit of `auto_flush_interval` but I think it's seconds. Normally all lines of a multiline message is logged in one swoop (most likely a single write operation) so you can have a quite low number here.
---
### Author:  [@Giulio](https://discuss.elastic.co/u/Giulio)
#### Post date: [April 18, 2016, 7:29am UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/3 "2016-04-18T07:29:39Z")
Hi
I have the same problem but I have already use the option auto\_flush\_interval as above:
tcp {
type =\> "log4j"
port =\> 5516
codec =\> multiline {
pattern =\> "^%{TIMESTAMP\_ISO8601} "
what =\> "previous"
negate =\> true
auto\_flush\_interval =\> 5
}
}
But nothing, the last string stay in a wait mode until a new one comes or the program.
I have no idea, the code seem correct to me.
Thank you
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 18, 2016, 7:36am UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/4 "2016-04-18T07:36:52Z")
Which version of Logstash are you using?
---
### Author:  [@Giulio](https://discuss.elastic.co/u/Giulio)
#### Post date: [April 18, 2016, 7:48am UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/5 "2016-04-18T07:48:53Z")
I'm using the 2.2.2 version
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791/6 "2017-07-06T05:01:54Z")