# File input monitoring a file or folder always reads from beginning
**URL:** https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002
**Category:** Logstash
**Created:** [May 2, 2016, 10:03pm UTC](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002 "2016-05-02T22:03:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gsgokul](https://discuss.elastic.co/u/gsgokul)
#### Post date: [May 2, 2016, 10:03pm UTC](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002/1 "2016-05-02T22:03:11Z")
I have a config that reads a folder in linux, issue is logstash always reads from beginning for each modification, After first successful run I add a log entry to the file, logstash reads from beginning instead of reading only the last entry. I removed sincedb files no luck, any help is appreciated
input {
file {
path =\> "/home/gsgokul/working/logs/\*"
start\_position =\> "beginning"
}
}
filter {
grok {
patterns\_dir =\> ["/home/gsgokul/working/patterns"]
match =\> { "message" =\> "%{IDENTIFI\_LOG}"}
}
date {
match =\> ["logdate", "YYYY-MM-dd HH:mm:ss,SSS"]
target =\> "@timestamp"
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2016, 8:11pm UTC](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002/2 "2016-05-08T20:11:55Z")
It seems like sincedb isn't working for you. If you start Logstash with `--verbose` it'll tell you more about what happens, like which sincedb file is used and what offset is read from it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002/4 "2017-07-06T04:58:40Z")