# Filebeat and truncated files **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 14, 2016, 12:35pm UTC](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054 "2016-10-14T12:35:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![apelsina](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@apelsina](https://discuss.elastic.co/u/apelsina)\ **Post date:** [October 14, 2016, 12:35pm UTC](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054/1 "2016-10-14T12:35:03Z")
What strategy should I use for filebeat in case when specific log file is being constantly truncated from the beginning? I use log files which are produced by third-party log system and I cannot maintain it. Produced files are being truncated after reaching 5 mb size but it keeps the same filename all the time. Will filebeat keep offset correctly if I set tail\_file=true? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [October 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054/2 "2016-10-17T11:35:49Z")
If a file gets truncated, filebeat will detect it and will start reading from the beginning again. As in all cases with truncation, this can lead to the problem that not all log files were sent before trucation, means data is lost. To make sure filebeat reads events as fast as possible to catch as many lines as possible before truncation, set a low backoff value. `tail_files` should be set to false as it doesn't help in this case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2016, 12:35pm UTC](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054/3 "2016-11-04T12:35:17Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.