# ERR " write: broken pipe"

**URL:** https://discuss.elastic.co/t/err-write-broken-pipe/115071
**Category:** Beats
**Tags:** filebeat
**Created:** [January 11, 2018, 11:37am UTC](https://discuss.elastic.co/t/err-write-broken-pipe/115071 "2018-01-11T11:37:14Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [January 22, 2018, 3:09pm UTC](https://discuss.elastic.co/t/err-write-broken-pipe/115071/6 "2018-01-22T15:09:43Z")

</div>

Hello, its because filebeat tracks inode changes to know if it needs to read the file or not. When you are editing with vim, every time that you save your file the inode change. Look at the number on the left in the following example.

```auto
ph@sashimi  /tmp  ls -li testing.log
4305672956 -rw-r--r-- 1 ph wheel 21 Jan 22 10:05 o.log
 ph@sashimi  /tmp  vim o.log
 ph@sashimi  /tmp  ls -li testing.log
4305672969 -rw-r--r-- 1 ph wheel 30 Jan 22 10:05 o.log
 ph@sashimi  /tmp 

```

When you are using `echo`, the inode won't change, this is the normal behavior when you are logging, you are appending to a file.

```auto
ph@sashimi  /tmp  ls -li echo.log
4305673010 -rw-r--r-- 1 ph wheel 2 Jan 22 10:06 echo.log
 ph@sashimi  /tmp  echo "no inode change" >> echo.log
 ph@sashimi  /tmp  ls -li echo.log
4305673010 -rw-r--r-- 1 ph wheel 18 Jan 22 10:06 echo.log

```

---

_[View the full topic](https://discuss.elastic.co/t/err-write-broken-pipe/115071)._