# Logstash sends last event only on shutdown
**URL:** https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348
**Category:** Logstash
**Created:** [February 10, 2016, 4:26am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348 "2016-02-10T04:26:04Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)
#### Post date: [February 10, 2016, 4:26am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/1 "2016-02-10T04:26:04Z")
Hello
I use logstash to parse log files and send result documents to elasticsearch. It seems to me that last log/event is not sent until new one appears. The only way I managed to make logstash send last event is turning it off. Then I can see last log in an elasticsearch index or an output file. I don't think it's a right way to get last log for production. Could anybody give me an advise if there is a way to configure logstash so it pushes last event after timeout?
I'm familiar with file plugin flush\_interval setting and elasticsearch plugin flush\_size/idle\_flush\_time settings. I tried to play with them but I still have the problem. Perhaps, there're some option I missed. Any ideas?
My config looks like:
> input {
> file {
> path =\> "/\*"
> codec =\> multiline {
> pattern =\> "^%{REDISTIMESTAMP} "
> negate =\> true
> what =\> previous
> }
> start\_position =\> "beginning"
> }
> }
> filter {
> ...
> }
> output {
> file { path =\> "output.log" }
> elasticsearch {
> index =\> "myIndex"
> }
> }
I wonder if the problem is related to a file input multiline code configuration.
Thanks in advance,
Vasiliy
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 10, 2016, 4:30am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/3 "2016-02-10T04:30:54Z")
This sounds like the behaviour often seen when using multiline codec/filter and Logstash is not able to determine when the final event has been completed.
---
### Author:  [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)
#### Post date: [February 10, 2016, 4:33am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/4 "2016-02-10T04:33:43Z")
I frankly can't get rid of multiline codec for now. Is there a way to affect on it in terms of flush/timeout?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 10, 2016, 4:38am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/5 "2016-02-10T04:38:05Z")
There is an [issue on GitHub tracking a fix for this](https://github.com/logstash-plugins/logstash-codec-multiline/pull/18). Filebeat has recently [added multiline support](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#multiline) and allows you to specify a timeout, which should allow you to avoid this problem.
---
### Author:  [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)
#### Post date: [February 10, 2016, 4:43am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/6 "2016-02-10T04:43:38Z")
It looks like GitHub issue is fixed. I've just discovered multiline codec auto\_flush\_interval option in its documentation. I also tried filebeat with multiline plugin and can confirm that there's no problem with last event. I simply want to make it work without filebeat for now. I will try auto\_flush\_interval and let you know. Thank you!
---
### Author:  [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)
#### Post date: [February 10, 2016, 5:08am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/7 "2016-02-10T05:08:01Z")
auto\_flush\_interval settings fixed my issue. Thank you one more time!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348/8 "2017-07-06T05:12:19Z")