# Processing binary data files, not processing the end lines

**URL:** <https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174>\
**Category:** Logstash\
**Created:** [August 11, 2015, 5:42am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174 "2015-08-11T05:42:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manjunath](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Manjunath](https://discuss.elastic.co/u/Manjunath)\
**Post date:** [August 11, 2015, 5:42am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174/1 "2015-08-11T05:42:11Z")

</div>

I tried processing a binary data file (Format application/octet-stream; charset=binary).  
Logstash is not processing the end lines, instead it starts processing from the almost middle of the file.  
Please help. I have to process the latest lines.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2015, 5:59am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174/2 "2015-08-11T05:59:07Z")

</div>

What does "latest lines" mean for a binary file? In my world binary file don't have lines. They're just blobs of data. What kind of files are you trying to get Logstash to read? What's your configuration?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2015, 6:20am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174/4 "2015-08-11T06:20:50Z")

</div>

There is no such thing as a "binary" character set. Figuring out what character set actually _is_ used could be helpful.

Your configuration looks generally sane (but see comments below) and since we seem to be dealing with text logs it's not obvious why Logstash would misbehave.

- Instead if `%{WORD:skip}`, just say `%{WORD}`. Then you don't need to remove the `skip` field either.
- Never use more than one GREEDYDATA or DATA pattern in a single expression. It can very easily backfire and result in weird matches.

---

<div class="post-metadata">

**Author:** ![Manjunath](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@Manjunath](https://discuss.elastic.co/u/Manjunath)\
**Post date:** [August 11, 2015, 6:22am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174/5 "2015-08-11T06:22:58Z")

</div>

wow.. that's some super advice. I will see why m getting wierd response.  
Thanks for your reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/processing-binary-data-files-not-processing-the-end-lines/27174/6 "2017-07-06T05:32:24Z")

</div>