# Duplicated logs from logstash after append logs

**URL:** <https://discuss.elastic.co/t/duplicated-logs-from-logstash-after-append-logs/39097>\
**Category:** Logstash\
**Created:** [January 13, 2016, 11:56am UTC](https://discuss.elastic.co/t/duplicated-logs-from-logstash-after-append-logs/39097 "2016-01-13T11:56:31Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![carmelom](https://avatars.discourse-cdn.com/v4/letter/c/e19adc/32.png) [@carmelom](https://discuss.elastic.co/u/carmelom)\
**Post date:** [January 13, 2016, 1:54pm UTC](https://discuss.elastic.co/t/duplicated-logs-from-logstash-after-append-logs/39097/5 "2016-01-13T13:54:39Z")

</div>

"on my test I opened the file and then modify it appending logs. "  
Step 1 : mylogs.log -\> empty  
Step 2 : open file mylogs.log -\> add new log in the file -\> save file  
`<dialogue> <server>localhost</server> <duration>165</duration> <outgoing><qvs_message appstate="getAPPSTATE_0"></qvs_record></qvs_message></outgoing> </dialogue>`  
--\> mylogs.log = 1 Log  
logstash (or filebeats) is reading the file the I can verify it with kibana and I have 1 log  
Step 3 : open file mylogs.log -\> add new log in the file -\> save file  
`<dialogue> <server>localhost</server> <duration>165</duration> <outgoing><qvs_message appstate="getAPPSTATE_1"></qvs_record></qvs_message></outgoing> </dialogue>`  
--\> mylogs.log = 2 Log  
logstash (or filebeats) is reading the file the I can verify it with kibana and I have 3 logs but I **extected 2 logs**

I hope this is well detailed

---

_[View the full topic](https://discuss.elastic.co/t/duplicated-logs-from-logstash-after-append-logs/39097)._