# AzureBlob Old/Existing logs not Ingesting

**URL:** <https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603>\
**Category:** Logstash\
**Created:** [August 3, 2020, 4:20pm UTC](https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603 "2020-08-03T16:20:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [August 3, 2020, 4:20pm UTC](https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603/1 "2020-08-03T16:20:15Z")

</div>

Hello,

Hope someone could help.

I have logstash ingesting logs from Azureblob storage. What happened is that logs stopped ingesting 2 days ago. Today I got it working again however, the logs from the last 2 days are not getting ingested as well. Is there any reason to this and a fix?

Below is my logstash input config:

```auto
input {
    azureblob {
        storage_account_name => " ***********"
        storage_access_key => " **********"
        container => "azureblob"
        add_field => { "service" => "logging" }
        tags => ['azure']
        codec => "json"
        registry_lease_duration => 60
        registry_create_policy => resume
        file_head_bytes => 0
        file_tail_bytes => 0
    }
}

```

I have tried changing the plugin parameter "registry\_create\_policy =\> **resume**" to "registry\_create\_policy =\> **start\_over**" but no joy.

Help would be much appreciated thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603/2 "2020-08-31T16:20:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.