Single line JSON file not being processed

Elastic Stack Beats
1

Hi Team,

I have Filebeat version 6.7.1 configured to read numerous JSON files as they come/go from a single directory. Some of the JSON files contain a single line with no newline character at the end.

My problem is that Filebeat will not process the single JSON line files unless I modify them by adding a newline character.

I tried adding the close_eof: true config option thinking that may help but no luck.

Any ideas?

Thanks,
Butch

2

Just found this in the Filebeat docs:

Filebeat isn’t shipping the last line of a file

Filebeat uses a newline character to detect the end of an event. If lines are added incrementally to a file that’s being harvested, a newline character is required after the last line, or Filebeat will not read the last line of the file.