# ELK creates lots of hidden files **URL:** \ **Category:** Logstash\ **Created:** [July 4, 2017, 10:57am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748 "2017-07-04T10:57:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nousees](https://avatars.discourse-cdn.com/v4/letter/n/58956e/32.png) [@nousees](https://discuss.elastic.co/u/nousees)\ **Post date:** [July 4, 2017, 10:57am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/1 "2017-07-04T10:57:47Z")
Hello everybody, I've just installed logstash, elasticsearch and kibana. The issue is that I've found lots of hidden files with this format: .1015766.51411.253032 .200184.53366.432265 I've found it in several directories and the number of them is increasing. Please, do you know how can I control those files to store in a particular directory? Who does create them? I'm not sure if logstash or elasticsearch. Is there some best practices for that? Thanks so much! ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [July 4, 2017, 11:08am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/2 "2017-07-04T11:08:25Z")
Hi, What version of the Elasticstack if being run here? Please share the directories under which you have found said hidden files? What OS is this currently running on? ---
**Author:** ![nousees](https://avatars.discourse-cdn.com/v4/letter/n/58956e/32.png) [@nousees](https://discuss.elastic.co/u/nousees)\ **Post date:** [July 4, 2017, 12:20pm UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/3 "2017-07-04T12:20:30Z")
Hi JKhondhu, I'm using 5.4.2 version of Elasticsearch under Debian 8.8. The directories under which I've found those hidden files are /etc/logstash/conf.d/ (where I've got the config file for logstash) and /var/log, where I've got the log file I pass to logstash. Thanks! ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [July 4, 2017, 12:28pm UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/4 "2017-07-04T12:28:49Z")
Hi, Please share your logstash.yml Right now I am going with [https://www.elastic.co/guide/en/logstash/current/persistent-queues.html#persistent-queues](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html#persistent-queues) - "you can enable persistent queues to buffer events on disk" ---
**Author:** ![nousees](https://avatars.discourse-cdn.com/v4/letter/n/58956e/32.png) [@nousees](https://discuss.elastic.co/u/nousees)\ **Post date:** [July 4, 2017, 12:32pm UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/5 "2017-07-04T12:32:40Z")
This is Logstash.yml content: path.data: /var/lib/logstash path.config: /etc/logstash/conf.d path.logs: /var/log/logstash ---
**Author:** ![nousees](https://avatars.discourse-cdn.com/v4/letter/n/58956e/32.png) [@nousees](https://discuss.elastic.co/u/nousees)\ **Post date:** [July 5, 2017, 9:45am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/6 "2017-07-05T09:45:21Z")
Hi, Well, I've just figured out this weird issue. The thing was that in logstash.conf I've got "sincedb\_path" param at this way: sincedb\_path =\> "" This was the only way I found to force logstash to parse from the begining of the document for each execution because start\_position =\> "beginning" didn't work for me. So, due to sincedb\_patch logstash creates a file from each execution. Thanks for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 2, 2017, 9:46am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748/7 "2017-08-02T09:46:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.