# Truncated log line

**URL:** <https://discuss.elastic.co/t/truncated-log-line/133543>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 28, 2018, 12:55pm UTC](https://discuss.elastic.co/t/truncated-log-line/133543 "2018-05-28T12:55:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![javadevmtl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/javadevmtl/32/45613_2.png) [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\
**Post date:** [May 28, 2018, 12:55pm UTC](https://discuss.elastic.co/t/truncated-log-line/133543/1 "2018-05-28T12:55:35Z")

</div>

Hi using Filebeat 6.2.2 and logrotate.

Logrotate is setup to rotate every 100MB.

When rotation happens we see that the last entry durring rotation gets cut in half. So some of the bytes of the line are in the old file and the rest in the new file.

This single line gets indexed as 2 separate events in ES.

Is there a way to fix this?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 5, 2018, 7:34am UTC](https://discuss.elastic.co/t/truncated-log-line/133543/2 "2018-06-05T07:34:12Z")

</div>

That more seems like an issue of the log rotation mechanism. If there are 2 different lines FB will ship it as 2 events.

---

<div class="post-metadata">

**Author:** ![javadevmtl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/javadevmtl/32/45613_2.png) [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\
**Post date:** [June 5, 2018, 3:23pm UTC](https://discuss.elastic.co/t/truncated-log-line/133543/3 "2018-06-05T15:23:47Z")

</div>

Ok I'm using DC/OS the DC/OS guys claim they use standard Linux logrotate. Does logrotate truncate a line when it reaches the maximum size?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 6, 2018, 12:07pm UTC](https://discuss.elastic.co/t/truncated-log-line/133543/4 "2018-06-06T12:07:54Z")

</div>

TBH I don't know. I would recommend to check the rotated log files and see if the messages are truncated.

TBH I would be surprised if logrotate with a default config cuts log lines in half as if this is the case I would expect quite a few more reports of this problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2018, 12:08pm UTC](https://discuss.elastic.co/t/truncated-log-line/133543/5 "2018-07-04T12:08:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.