# \[Filebeat\] Filestream ignore\_inactive setting not working correctly

**URL:** <https://discuss.elastic.co/t/filebeat-filestream-ignore-inactive-setting-not-working-correctly/364669>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 9, 2024, 11:33am UTC](https://discuss.elastic.co/t/filebeat-filestream-ignore-inactive-setting-not-working-correctly/364669 "2024-08-09T11:33:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![boernd](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@boernd](https://discuss.elastic.co/u/boernd)\
**Post date:** [August 9, 2024, 11:33am UTC](https://discuss.elastic.co/t/filebeat-filestream-ignore-inactive-setting-not-working-correctly/364669/1 "2024-08-09T11:33:04Z")

</div>

We are running Filebeat in Kubernetes in autodiscover mode. When configuring the filestream input type with a new registry data path (so clean state from the beginning) and setting `ignore_inactive` to `since_last_start` it still reads files from the beginning.

The doc though states the following ([filestream input | Filebeat Reference [8.15] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#filebeat-input-filestream-ignore-inactive)):  
`For files that were never seen before, the offset state is set to the end of the file.`

Tested configuration:

```auto
filebeat.registry.path: ${path.data}/logs-registry

filebeat.autodiscover:
 providers:
   - type: kubernetes
     node: ${NODE_NAME}
     hints.enabled: true
     hints.default_config:
       type: filestream
       id: kubernetes-container-logs-${data.kubernetes.pod.name}-${data.kubernetes.container.id}
       paths:
       - /var/log/pods/${data.kubernetes.namespace}_${data.kubernetes.pod.name}_${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log
       ignore_inactive: since_last_start
       parsers:
       - container: ~
       prospector:
        scanner:
          fingerprint.enabled: true
          symlinks: false
       file_identity.fingerprint: ~

```