# Does Filebeat take in logs missed when it is stopped?

**URL:** <https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 5, 2021, 3:42am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130 "2021-05-05T03:42:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)\
**Post date:** [May 5, 2021, 3:42am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130/1 "2021-05-05T03:42:30Z")

</div>

I have filebeat 7.8.1 streaming logs to my elasticsearch via this setup

Application -\> Logfile -\> Filebeat -\> Logstash -\> Elasticsearch

The application team is concerned if Filebeat is down, it will cause logs to be missed,  
Will Filebeat be able to detect which logs are sent during it's downtime and automatically send them to logstash when it is turned back on?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 5, 2021, 4:07am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130/2 "2021-05-05T04:07:50Z")

</div>

Filebeat [tracks](https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#_how_does_filebeat_keep_the_state_of_files) the position of the harvested files, if you stop filebeat and start again later, it will read from the last know position when it was running.

If the log is rotated while filebeat was in a stop state it will not be able to send the events that happened between that time.

But you can always reparse the logs if needed.

---

<div class="post-metadata">

**Author:** ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)\
**Post date:** [May 5, 2021, 6:01am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130/3 "2021-05-05T06:01:39Z")

</div>

I see, thank you very much for the quick response

---

<div class="post-metadata">

**Author:** ![shifenglim](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@shifenglim](https://discuss.elastic.co/u/shifenglim)\
**Post date:** [May 5, 2021, 7:58am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130/4 "2021-05-05T07:58:01Z")

</div>

Hi leandrojmp,

The application team tried to delete the log file and each time the log file is deleted, in the directory /data/registry/filebeat/log.json keeps growing in size

Would this be a concern if this log.json keeps growing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2021, 9:58am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130/5 "2021-06-02T09:58:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.