# About ETL processing failure (RSYSLOG)

**URL:** <https://discuss.elastic.co/t/about-etl-processing-failure-rsyslog/366438>\
**Category:** Logstash\
**Created:** [September 12, 2024, 12:40am UTC](https://discuss.elastic.co/t/about-etl-processing-failure-rsyslog/366438 "2024-09-12T00:40:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nw-engineer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nw-engineer/32/131876_2.png) [@nw-engineer](https://discuss.elastic.co/u/nw-engineer)\
**Post date:** [September 12, 2024, 12:40am UTC](https://discuss.elastic.co/t/about-etl-processing-failure-rsyslog/366438/1 "2024-09-12T00:40:33Z")

</div>

I am using Logstash (version 8.4.3) to process and index log data received via RSYSLOG.

RSYSLOG is configured to perform log rotation with the following parameters:

hourly  
missingok  
compress  
rotate 1  
nocopy  
nocreate  
nodateext

At times, when log rotation is executed, Logstash reads a partial log entry, causing the ETL process to fail, and the log data is not indexed properly.

The "start\_position" is set to "end," and "sincedb\_path" is explicitly defined. Additionally, to account for inode issues, "sincedb\_clean\_after" is set to 0.25, and "mode" is set to "tail."

Is there a way to prevent this intermittent issue from occurring? Any suggestions would be greatly appreciated.