# Every time read file from beginning when modified

**URL:** <https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 17, 2020, 7:57pm UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030 "2020-09-17T19:57:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Post date:** [September 17, 2020, 7:57pm UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030/1 "2020-09-17T19:57:49Z")

</div>

HI,

I have a use case where a file is replaced with additional details periodically. I was using filebeat to do that but I see filebeat maintains an offset and considers it as same file and starts reading from the line where it left. causing the data loss.  
Is there a way that I can always force filebeat to read the file from beginning whenever it is modified/replaced?

Other option that I found was using file input plugin that offers this option with setting since\_db as /dev/null and start\_position as "beginning". However my file is remote so can not use that plugin.

Please suggest.

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [September 18, 2020, 8:03am UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030/2 "2020-09-18T08:03:52Z")

</div>

I think you need to review some rules regarding the log rotation: [https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html](https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html)

---

<div class="post-metadata">

**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Post date:** [September 18, 2020, 9:25pm UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030/3 "2020-09-18T21:25:41Z")

</div>

In my case every day a new file is placed in the directory . 1 file is maintained per day and and is replaced every our within a day .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2020, 11:25pm UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030/4 "2020-10-16T23:25:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.