Logstash is probably tailing the file and waiting for more input. If you want to make sure it's processed from the beginning, shut down Logstash, delete the sincedb files, then start again.
The file input documentation will tell you the rules for where the sincedb files are created (unless you specify a path yourself). You can side-step that problem by picking a path yourself and setting it with sincedb_path.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.