# Configure Filebeat not to rotate file on restart

**URL:** https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525
**Category:** Beats
**Tags:** filebeat
**Created:** [August 16, 2019, 3:58pm UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525 "2019-08-16T15:58:25Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Romano](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@Romano](https://discuss.elastic.co/u/Romano)
#### Post date: [August 16, 2019, 3:58pm UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/1 "2019-08-16T15:58:25Z")

</div>

I am using filebeat to parse some logs and collect data for a month. System uses logrotate to rotate file when needed. Filebeat system fits perfectly for me, because It starts up on server restart, and easy to setup the output.file task.  
However the problem is that, when filebeat restarts, it would rotate the file I am sending the output to. How do I configure filebeat to never rotate the file?

---

<div class="post-metadata">

### Author: ![Romano](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@Romano](https://discuss.elastic.co/u/Romano)
#### Post date: [August 20, 2019, 8:27am UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/2 "2019-08-20T08:27:28Z")

</div>

It seems there is no way to stop filebeat rotating files. I will have to look for another solution for my task.

---

<div class="post-metadata">

### Author: ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 20, 2019, 7:28pm UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/3 "2019-08-20T19:28:33Z")

</div>

There is a flag, `rotateonstartup`, that might help, see the [docs here](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-logging.html)

---

<div class="post-metadata">

### Author: ![Romano](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@Romano](https://discuss.elastic.co/u/Romano)
#### Post date: [August 21, 2019, 8:15am UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/4 "2019-08-21T08:15:15Z")

</div>

Thanks, but that is for logging (`logging.files.rotateonstartup`). I tried both and it did not help:  
`logging.files.rotateonstartup: false`  
`output.file.rotateonstartup: false`

---

<div class="post-metadata">

### Author: ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 22, 2019, 5:18pm UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/5 "2019-08-22T17:18:46Z")

</div>

Ah, you're right. But then I'm confused -- filebeat should not be rotating the files it's tracking (there is an [open feature request](https://github.com/elastic/beats/issues/7633) to add this capability but it isn't there yet. Is it possible that this is related to the logrotate configuration?

---

<div class="post-metadata">

### Author: ![Romano](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@Romano](https://discuss.elastic.co/u/Romano)
#### Post date: [August 23, 2019, 9:31am UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/6 "2019-08-23T09:31:20Z")

</div>

Hi, sorry my fault I have just realized that op post is not clear, I have modified it slightly, but will explain in here in a bit more detail.

Setup: VPN Server logs connections and various information into /var/log/openvpn.log. Logrotate rotates them daily. I was assigned a task to gather statistics and report every month, how many connections events happened per user. VPN server logs connection events per user into said /var/log/openvpn.log. All we need to know is that there is a log file, need to extract lines that match my criteria and store in another file, one file per month.

I use filebeat to monitor file, grep for information I need and send output into `output.file:`. So I need one text file which has all data for a month, and I will use scripts to count events, etc.  
Here is example of my config:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/openvpn.log
  include_lines: ["Peer Connection Initiated"]

output.file:
  enabled: true
  codec.format:
    string: '%{[message]}'
  path: "/var/log"
  filename: "openvpn-connections.log"

```

It works great, except when I restart server or filebeat service. When Filebeat service restarts, it would rotate `openvpn-connections.log` file. I need filebeat not to rotate this file, it never reaches 10 MB and the file would be rotated when needed (first day of any month) without the need of filebeat to do that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2019, 9:36am UTC](https://discuss.elastic.co/t/configure-filebeat-not-to-rotate-file-on-restart/195525/7 "2019-09-20T09:36:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
