# Filebeat for logs that send once every couple days **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 25, 2019, 8:38pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370 "2019-11-25T20:38:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Post date:** [November 25, 2019, 8:38pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370/1 "2019-11-25T20:38:12Z")
Hi, I'm running into some issues with logs I'm shipping with filebeat to logstash. I'm not quite sure what the issue is, but the file with the logs only refreshes once a day or once every two days with one or two lines that I want to send to Logstash. Data is flowing in on occasion, but usually a day or so late. So the connection works, but it just doesn't seem to work well if the logs are not flowing constantly -- I have another log file on the same machine with the same filebeat that is constantly being appended to and that one is flowing to logstash just fine. Is there some filebeat setting I need to explicitly set in this situation where the log file isn't constantly being appended to? My filebeat is: ```auto - type: log tags: ["test"] # Change to true to enable this input configuration. enabled: true # clean_inactive: 15s # ignore_older: 8s # scan_frequency: 1s # close_timeout: 10s - C:\Elastic\logs\test.log ``` As you can tell it's from a windows machine ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 26, 2019, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370/2 "2019-11-26T15:35:50Z")
Don't use `ignore_older` in this case, as it tells Filebeat to ignore files that hasn't been updated for a while. Same goes for `clean_inactive`. If you enable it, it removes the entry from the registry after the configured interval, so Filebeat reads the file again from the beginning if it encounters it. Could you please share the debug logs of Filebeat? ---
**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Post date:** [November 26, 2019, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370/3 "2019-11-26T16:05:11Z")
I would love to but there's a lot of sensitive data in there, is there any suggestion you have without seeing it? I didn't make any additional file beat config changes, and I can see that the harvester is running, it looks into that file and reports that there's no change in it, until it gets to `2019-11-25T05:46:31.734-0800 INFO log/harvester.go:279 File is inactive: C:\Elastic\logs\test.log. Closing because close_inactive of 5m0s reached.`... and no errors in it. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 27, 2019, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370/4 "2019-11-27T14:08:35Z")
You could test if you write the log file Filebeat is able to find it. Look for "Start next scan" in the debug logs. If Filebeat cannot pick it up during the scan, something is not right. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 25, 2019, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-for-logs-that-send-once-every-couple-days/209370/5 "2019-12-25T14:08:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.