# File output with append only files

**URL:** <https://discuss.elastic.co/t/file-output-with-append-only-files/78064>\
**Category:** Logstash\
**Created:** [March 9, 2017, 10:57pm UTC](https://discuss.elastic.co/t/file-output-with-append-only-files/78064 "2017-03-09T22:57:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikanderson753](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@erikanderson753](https://discuss.elastic.co/u/erikanderson753)\
**Post date:** [March 9, 2017, 10:57pm UTC](https://discuss.elastic.co/t/file-output-with-append-only-files/78064/1 "2017-03-09T22:57:27Z")

</div>

We are experimenting with setting up a file output to store certain types of logs. Right after the file is created by logstash we are using `incron` to set the file to append only with `chattr +a`.

Logstash writes to the file fine after this change. After a period of inactivity logstash closes the file. When it goes to reopen the file it causes a crashing error that it can't access the file.

I'm not seeing any explicit option in the documentation but Is there a way to disable logstash closing the file?

I'm reading through the code to find out [https://github.com/logstash-plugins/logstash-output-file](https://github.com/logstash-plugins/logstash-output-file)

---

<div class="post-metadata">

**Author:** ![erikanderson753](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@erikanderson753](https://discuss.elastic.co/u/erikanderson753)\
**Post date:** [March 15, 2017, 4:21pm UTC](https://discuss.elastic.co/t/file-output-with-append-only-files/78064/2 "2017-03-15T16:21:58Z")

</div>

Opened issue in github, it looks like the issue is that jruby 1.7.x has a bug with opening files in append only mode

> <https://github.com/logstash-plugins/logstash-output-file/issues/51>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2017, 4:22pm UTC](https://discuss.elastic.co/t/file-output-with-append-only-files/78064/3 "2017-04-12T16:22:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.