# Behaviour of logstash restart

**URL:** <https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022>\
**Category:** Logstash\
**Created:** [February 22, 2018, 10:15am UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022 "2018-02-22T10:15:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kasun\_Siyambalapitiy](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kasun\_Siyambalapitiy](https://discuss.elastic.co/u/Kasun_Siyambalapitiy)\
**Post date:** [February 22, 2018, 10:15am UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022/1 "2018-02-22T10:15:41Z")

</div>

I have a logstash setup configured for publishing events from a file (once a new record gets added into a log file) Currently the logstash process has stopped on my instance. What happens if I restart logstash, does it will start publishing from top of the file or from where it lastly published?. The instance which logstash was running haven't been restarted.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 10:53am UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022/2 "2018-02-22T10:53:37Z")

</div>

> What happens if I restart logstash, does it will start publishing from top of the file or from where it lastly published?

The depends on your configuration.

---

<div class="post-metadata">

**Author:** ![Kasun\_Siyambalapitiy](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kasun\_Siyambalapitiy](https://discuss.elastic.co/u/Kasun_Siyambalapitiy)\
**Post date:** [February 22, 2018, 11:21am UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022/3 "2018-02-22T11:21:13Z")

</div>

Hi magnusbaeck,

Thanks for the quick feedback. This is the configuration

```
input {
  file {
    path => "/opt/nginx/logs/updates.log"
    type => "updates_log"
  }
}

filter {
  if [type] == "updates_log" {
  mutate { replace => { "type" => "updates_log" } }
  grok {
    match => { "message" => "Message being sent" }
  }
  date {
    match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
  }
  geoip {
    source => "clientip"
  }
}
}

output {
  if [type] == "updates_log" {
          http {
    url => "URL of the receiver"
    http_method => "post"
    format => "json"
    headers => [
      'Authorization', 'Basic sampleBearer’
    ]
  }
}
}

```

Will it start publishing from top of the file once logstash is restarted?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 12:15pm UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022/4 "2018-02-22T12:15:09Z")

</div>

> Will it start publishing from top of the file once logstash is restarted?

No. The file input documentation describes this in detail.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2018, 12:15pm UTC](https://discuss.elastic.co/t/behaviour-of-logstash-restart/121022/5 "2018-03-22T12:15:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.