# Do Logstash monitors the folders?

**URL:** <https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730>\
**Category:** Logstash\
**Created:** [February 20, 2017, 12:28pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730 "2017-02-20T12:28:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rlv\_praveen](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@rlv\_praveen](https://discuss.elastic.co/u/rlv_praveen)\
**Post date:** [February 20, 2017, 12:28pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/1 "2017-02-20T12:28:24Z")

</div>

Hi All,

I have a special scenario in my application i am using log4j for logging purpose. The maximum size of the log file which i configured is 5 MB , if the file reached to 5 MB it renames the file and take a back up and start logging the logs. So in that case how does the logstash handles the monitoring will it take the renamed file also as a new file and do the parsing ? Please explain me in this scenario.

Thanks and Regards,  
Praveen

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2017, 12:51pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/2 "2017-02-20T12:51:46Z")

</div>

Logstash tracks files via their inode numbers so renamed files will not be treated as new.

---

<div class="post-metadata">

**Author:** ![rlv\_praveen](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@rlv\_praveen](https://discuss.elastic.co/u/rlv_praveen)\
**Post date:** [February 20, 2017, 1:00pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/3 "2017-02-20T13:00:46Z")

</div>

Thanks @magnusbaeck then even though my file is getting renamed logstash will now re-parse it. Is my understanding correct.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2017, 1:10pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/4 "2017-02-20T13:10:39Z")

</div>

If you have file A that's renamed to A.old and then A is recreated, Logstash will not care about A.old but it will start to read new entries from the new file A.

This is at least true with `start_position => end` (which is the default).

---

<div class="post-metadata">

**Author:** ![rlv\_praveen](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@rlv\_praveen](https://discuss.elastic.co/u/rlv_praveen)\
**Post date:** [February 20, 2017, 1:47pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/5 "2017-02-20T13:47:23Z")

</div>

Ok Got your point Thanks a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2017, 1:47pm UTC](https://discuss.elastic.co/t/do-logstash-monitors-the-folders/75730/6 "2017-03-20T13:47:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.