# Adding only the appended part of a file to elastic using logstash

**URL:** <https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520>\
**Category:** Elasticsearch\
**Created:** [March 13, 2023, 4:37am UTC](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520 "2023-03-13T04:37:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aks03](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@aks03](https://discuss.elastic.co/u/aks03)\
**Post date:** [March 13, 2023, 4:37am UTC](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520/1 "2023-03-13T04:37:35Z")

</div>

Hey everyone,  
I am new to Elk stack but currently I want to add only the appended part of a file i.e, any extra content added to the file to elastic using logstash 6.3.  
The files are unstructured so even that has left me confused on how to approach it.

```auto
input {
  file {
    path => "file path"
    start_position => "beginning"
  }
}

filter {
  # Add any necessary filters here
    date {
    match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
  }
}

output {
  elasticsearch {
    hosts => ["hostname:9200"]
    index => "test-index"
  }

}

```

I have been trying to add contents of file using this code but even that has not been possible until now.  
Any advice or help is appreciated.  
Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2023, 4:37am UTC](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520/2 "2023-03-13T04:37:35Z")

</div>

logstash 6.3 is [EOL](https://www.elastic.co/support/eol) and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2023, 4:37am UTC](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520/3 "2023-04-10T04:37:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.