# File input processing question

**URL:** https://discuss.elastic.co/t/file-input-processing-question/27442
**Category:** Logstash
**Created:** [August 15, 2015, 3:44pm UTC](https://discuss.elastic.co/t/file-input-processing-question/27442 "2015-08-15T15:44:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jjdepaul](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)
#### Post date: [August 15, 2015, 3:44pm UTC](https://discuss.elastic.co/t/file-input-processing-question/27442/1 "2015-08-15T15:44:27Z")

</div>

I have logstash config file setup as shown below. It is monitoring demo directory for specific file pattern. It finds the log file and reads it, but once it reads it I can't ever convince it to re-read it from the beginning. It's normally a good thing that it remembers, but I'm still working out bugs in my conf file and I need to re-load the index from time to time from the beginning of the file. How can I convince it to read that input file from the beginning once again?!

I've tried the start\_position =\> "beginning", but no luck...

```
Here is my config today:
input { 
    # Log file
    file {
       path => "C:/logstash-1.5.3/demo/System*.log"
       #type => "sysout"
       start_position => "beginning"
      }
      
      # Standard input file
      #stdin { }
}  

filter {
  if [path] =~ "SLIC" {
    mutate { replace => { "type" => "slic" } }
  } else {
    mutate { replace => { "type" => "sysout" } }
  }
  grok {
    match => [
      "message",
      "^\[%{DATESTAMP:tslice} GMT\] %{NUMBER} CurrencyExcha %{GREEDYDATA} (%{WORD:status}(\.)?)"
    ]
  }
  if "_grokparsefailure" in [tags] {
          drop { }
  }  
}
    
output { 
    elasticsearch {
        host => localhost
        index => "sprint"
    }
    stdout { 
        codec => rubydebug 
    } 
}
```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 15, 2015, 10:25pm UTC](https://discuss.elastic.co/t/file-input-processing-question/27442/2 "2015-08-15T22:25:30Z")

</div>

This is a sincedb issue, there's a bunch of other threads on this so just do a search on that and you should be good 🙂

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 16, 2015, 2:33pm UTC](https://discuss.elastic.co/t/file-input-processing-question/27442/3 "2015-08-16T14:33:46Z")

</div>

I have an [open pull request](https://github.com/logstash-plugins/logstash-input-file/pull/61) that attempts to document the sincedb files and related matters a little better. Please feel free to comment if it isn't clear or if it doesn't answer your questions.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/file-input-processing-question/27442/4 "2017-07-06T05:31:53Z")

</div>


