# Displays specifically which lines have been changed in the file **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [August 13, 2024, 2:01am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808 "2024-08-13T02:01:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Erik\_Dito\_Tampubolon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_dito_tampubolon/32/136733_2.png) [@Erik\_Dito\_Tampubolon](https://discuss.elastic.co/u/Erik_Dito_Tampubolon)\ **Post date:** [August 13, 2024, 2:01am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/1 "2024-08-13T02:01:54Z")
Does auditbeat (file integrity module) make it possible to display modified lines in a file? For example, when I change the content of a file, auditbeat can display at what line the content of the file has been changed. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 13, 2024, 2:15am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/2 "2024-08-13T02:15:34Z")
Hello and welcome, > [@Erik\_Dito\_Tampubolon](#): > > Does auditbeat (file integrity module) make it possible to display modified lines in a file? > > For example, when I change the content of a file, auditbeat can display at what line the content of the file has been changed. No, it will not show the difference in the content of the file, just if the file was changed. ---
**Author:** ![Erik\_Dito\_Tampubolon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_dito_tampubolon/32/136733_2.png) [@Erik\_Dito\_Tampubolon](https://discuss.elastic.co/u/Erik_Dito_Tampubolon)\ **Post date:** [August 13, 2024, 2:20am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/3 "2024-08-13T02:20:59Z")
Hi sir, Is there any reference that auditbeat can't do that thing? and can filebeat do that? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 13, 2024, 2:39am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/4 "2024-08-13T02:39:44Z")
> [@Erik\_Dito\_Tampubolon](#): > > Hi sir, Is there any reference that auditbeat can't do that thing? The [documentation](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html#_how_it_works_2) explains how it works. > This module uses features of the operating system to monitor file changes in realtime. When the module starts it creates a subscription with the OS to receive notifications of changes to the specified files or directories. Upon receiving notification of a change the module will read the file’s metadata **and the compute a hash of the file’s contents**. It uses the hash of the file contents, not the content itself. So, if a file has changed, the calculated hash would be different, but you will not have any information about what were the changes. > [@Erik\_Dito\_Tampubolon](#): > > and can filebeat do that? Filebeat also cannot do that, it is designed to read the content of files and send it to Elasticsearch and it keep track of what was already read from a file. You can however configure it to read the same file multiple times, but it will not compare with any previous version, you would need to compare it yourself. What are you trying to achieve? ---
**Author:** ![Erik\_Dito\_Tampubolon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_dito_tampubolon/32/136733_2.png) [@Erik\_Dito\_Tampubolon](https://discuss.elastic.co/u/Erik_Dito_Tampubolon)\ **Post date:** [August 13, 2024, 2:55am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/5 "2024-08-13T02:55:26Z")
I want to achieve to view modified lines in a file, sir ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 13, 2024, 3:09am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/6 "2024-08-13T03:09:12Z")
> [@Erik\_Dito\_Tampubolon](#): > > I want to achieve to view modified lines in a file, sir Yeah, but what is the goal for this? What you want to monitor and track? What are the requirements? What kind of files? Depending on what you want to do you may be able to implement something with a custom script using `diff` or maybe even use `git` to track change. ---
**Author:** ![Erik\_Dito\_Tampubolon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_dito_tampubolon/32/136733_2.png) [@Erik\_Dito\_Tampubolon](https://discuss.elastic.co/u/Erik_Dito_Tampubolon)\ **Post date:** [August 13, 2024, 3:26am UTC](https://discuss.elastic.co/t/displays-specifically-which-lines-have-been-changed-in-the-file/364808/7 "2024-08-13T03:26:07Z")
My goal is to monitor changes in the content of a file, what I want to monitor is all types of files in a directory, for example (/var/www/html). And the changes can be seen on which line the changes occurred.