# Duplicates events when file rotation occurs - Windows

**URL:** <https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 20, 2016, 1:30pm UTC](https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315 "2016-06-20T13:30:42Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\
**Post date:** [July 4, 2016, 1:47pm UTC](https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315/12 "2016-07-04T13:47:18Z")

</div>

Hello,

Good news, I've reproduced the behavior under Win7 with my little sample program.  
Then, with 5.0.0-alpha4 this does't duplicate data on rollover.  
🙂

If you want code to reproduce:  
[https://github.com/blavoie/filebeat-rotate-test](https://github.com/blavoie/filebeat-rotate-test)

I will send the latest binary file to ops to make the update on each servers.

Just to be safe, as stated here:

> [@Filebeat Not harvesting, file didn't change - do not use modification time](https://discuss.elastic.co/t/filebeat-not-harvesting-file-didnt-change-do-not-use-modification-time/49834/11):
>
> @logstash_oz @wmcdonald The newest version of filebeat (5.0.0-alpha3) now relies much less on the modification date for harvesting. Could you try out if this version resolves the above issues?

And seen here:

> <https://github.com/elastic/beats/blob/aad3b005db7bd9ea37eae2d75cbaa8cb1b41acb4/filebeat/prospector/prospector_log.go#L149-L151>

The harvester doesn't monitor file based on moddate but now on size?  
Is it safe to make close\_older to something more appropriate? 30h --\> 1h

Thanks  
Bruno Lavoie

---

_[View the full topic](https://discuss.elastic.co/t/duplicates-events-when-file-rotation-occurs-windows/53315)._