# Does logstash update the .sincedb file after a log file is completely read or during the reading process?

**URL:** <https://discuss.elastic.co/t/does-logstash-update-the-sincedb-file-after-a-log-file-is-completely-read-or-during-the-reading-process/64997>\
**Category:** Logstash\
**Created:** [November 4, 2016, 9:43am UTC](https://discuss.elastic.co/t/does-logstash-update-the-sincedb-file-after-a-log-file-is-completely-read-or-during-the-reading-process/64997 "2016-11-04T09:43:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mayank\_Agrawal](https://avatars.discourse-cdn.com/v4/letter/m/3ab097/32.png) [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\
**Post date:** [November 4, 2016, 9:43am UTC](https://discuss.elastic.co/t/does-logstash-update-the-sincedb-file-after-a-log-file-is-completely-read-or-during-the-reading-process/64997/1 "2016-11-04T09:43:02Z")

</div>

Does Logstash update the .sincedb file after a log file is read till the end or during the reading process ?

For example:  
Let's say there is directory which is being monitored by Logstash. A file [say file1.log with max offset (file size) as 10000] is copied into this directory.

Does .sincedb file gets updated/created (if not already present) with the info of file1.log when the Logstash reaches offset 10000 ?

What I think is logstash should update the .sincedb file on regular basis, but what I have noticed is that it gets updated/created after a file is completely read.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/does-logstash-update-the-sincedb-file-after-a-log-file-is-completely-read-or-during-the-reading-process/64997/2 "2017-07-06T04:31:06Z")

</div>

Closed on July 6, 2017, 4:31am UTC