# Deleted sincedb files, no new are getting created
**URL:** https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536
**Category:** Logstash
**Created:** [October 7, 2016, 11:51pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536 "2016-10-07T23:51:43Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [October 7, 2016, 11:51pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/1 "2016-10-07T23:51:43Z")
Ok, so I decided to delte my .sincedb files, and they never reappeared. ☹
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 8, 2016, 9:07am UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/2 "2016-10-08T09:07:24Z")
Did you restart LS?
---
### Author:  [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [October 8, 2016, 5:12pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/3 "2016-10-08T17:12:03Z")
Yes sir. Several times. The .sincedb files used to be under /root
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 8, 2016, 8:35pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/4 "2016-10-08T20:35:31Z")
What does your config look like?
---
### Author:  [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [October 10, 2016, 9:32pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/5 "2016-10-10T21:32:06Z")
Hey warklom,
So I belive someone must have restarted Logstash in my server, before Logstash was running as root, but i guess someone made it run as Logstash, and the sincedb files started to get saved under /opt/logstash/ , haha. Or maybe the reason the files begin to go under /opt/logstash is because I used the start\_position =\> beginning once? Anyways, I am however facing a new issue. So I have a file that has new things appended to it as a newline every once in a while, which are the new messages. So when a new mesage comes in, Logstash pickups up the new event, and the previous both, as new events. I beleive I can fix this issue using the Codec multi-line filter correct?
---
### Author:  [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [October 11, 2016, 7:01pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/6 "2016-10-11T19:01:24Z")
However today I logged into a Logstash Indexer box today, and I found absolutely no Logstash sincedb file.
find / -name "_since_" 2\> /dev/null
The above find command returns 0 results. This time I have no idea why there is none. This logstash configuration looks something like:
input {
```
redis
{ host => "ip.add.re.ss7"
data_type => "list"
key => "redis-key"
codec => json
threads => 2
}
```
}
output {
else if [appname] == "appname-value" {
elasticsearch {
hosts =\> ["[hostname.com:9224](http://hostname.com:9224)","[hostname.com:9224](http://hostname.com:9224)","[hostname.com:9224](http://hostname.com:9224)"]
index =\> "index-name-%{+[YYYY.MM](http://YYYY.MM)}"
user =\> "username"
password =\> "password"
ssl =\> true
cacert =\> '/opt/logstash/something.pem'
}
}
}
Any ideas fellow loggers?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536/7 "2017-07-06T04:34:41Z")