# Filebeat: anything to know about rotating logfiles?

**URL:** https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331
**Category:** Beats
**Tags:** filebeat
**Created:** [August 29, 2019, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331 "2019-08-29T12:11:29Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [August 29, 2019, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331/1 "2019-08-29T12:11:29Z")

</div>

Hi,

I am monitoring a jboss application with a lot of logfiles. Log4j is taking care of log rotating. Files are rotated when a given size is reached and a suffix is added.

In the past I always told filebeat to use \*.log, so \*.log.1 is out of scope.

1. Is my unerstanding correct, that filebeat will read the last lines of log.1, if it was rotated before being read by filebeat, because the inode id of the logfile remains when the file is rotated? So filebeat will read \*.log and rotated \*.log.1?
2. If I would set filebeat to look on _log_, would it have in the end the same effect as \*.log ? Because no new lines are ever added to already rotated logs.
3. How is it on windows? Is filebeat also using some identifier which lives longer than a file renaming?

I just want to make sure, that I did not understood anything wrong and that we may lose or duplicate log lines on production.

Thanks, Andreas

---

<div class="post-metadata">

### Author: ![kumarabhi](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [August 29, 2019, 6:15pm UTC](https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331/2 "2019-08-29T18:15:47Z")

</div>

Please refer [Handeling log rotation](https://discuss.elastic.co/t/handeling-log-rotation/109660/4)

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [August 30, 2019, 6:26am UTC](https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331/3 "2019-08-30T06:26:05Z")

</div>

thanks, that thread answered first to questions.

Is it the same on windows, or does filebeat miss an equivalent to linux' inodes?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2019, 6:26am UTC](https://discuss.elastic.co/t/filebeat-anything-to-know-about-rotating-logfiles/197331/4 "2019-09-27T06:26:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
