# Abnormal "file" input behavior?
**URL:** https://discuss.elastic.co/t/abnormal-file-input-behavior/23515
**Category:** Elasticsearch
**Created:** [May 1, 2015, 7:04pm UTC](https://discuss.elastic.co/t/abnormal-file-input-behavior/23515 "2015-05-01T19:04:43Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Sitkawoof](https://discuss.elastic.co/u/Sitkawoof)
#### Post date: [May 1, 2015, 7:04pm UTC](https://discuss.elastic.co/t/abnormal-file-input-behavior/23515/1 "2015-05-01T19:04:43Z")
I have a file of logging records I am using to debug some "filter" parses.
I am using "file" input and have set "starting\_position" to "beginning".
So I startup logstash see what I get and killed it and make fixes and go
again. I have seen if sometimes it reads the file and sometimes not. I
ran some experiments and found that if I delete the file and rewrite it and
then start up logstash it reads the file. If I have previously read the
file, then when logstash starts it doesn't read the file despite being
told to start at beginning.
Am I missing something here? Is this intended behavior or a possible bug?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7ad0633b-0e9d-4f10-8881-5a34c93c9500%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7ad0633b-0e9d-4f10-8881-5a34c93c9500%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 4, 2015, 6:46am UTC](https://discuss.elastic.co/t/abnormal-file-input-behavior/23515/2 "2015-05-04T06:46:50Z")
On Friday, May 01, 2015 at 21:04 CEST,
Sitka [sitkawoof@gmail.com](mailto:sitkawoof@gmail.com) wrote:
> I have a file of logging records I am using to debug some "filter"
> parses. I am using "file" input and have set "starting\_position" to
> "beginning". So I startup logstash see what I get and killed it and
> make fixes and go again. I have seen if sometimes it reads the file
> and sometimes not. I ran some experiments and found that if I delete
> the file and rewrite it and then start up logstash it reads the file.
> If I have previously read the file, then when logstash starts it
> doesn't read the file despite being told to start at beginning.
> Am I missing something here? Is this intended behavior or a possible
> bug?
This is the intended behavior and documented at
> **[File input plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html)**
```
"This option only modifies 'first contact' situations where
a file is new and not seen before. If a file has already
been seen before, this option has no effect."
```
If you want to force Logstash to reprocess a file, delete
the corresponding sincedb file (or entry within such a file).
For testing purposes it's much more convenient to use the
stdin input.
Next time, please post Logstash questions like this one to the
logstash-users list.
--
Magnus Bäck | Software Engineer, Development Tools
[magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20150504064649.GA19365%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20150504064649.GA19365%40seldlx20533.corpusers.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:16am UTC](https://discuss.elastic.co/t/abnormal-file-input-behavior/23515/3 "2017-07-06T00:16:03Z")