# Filebeat Ignore command

**URL:** <https://discuss.elastic.co/t/filebeat-ignore-command/354637>\
**Category:** Elasticsearch\
**Created:** [March 4, 2024, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-ignore-command/354637 "2024-03-04T12:27:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amjad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amjad/32/140039_2.png) [@amjad](https://discuss.elastic.co/u/amjad)\
**Post date:** [March 4, 2024, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-ignore-command/354637/1 "2024-03-04T12:27:44Z")

</div>

```auto
Hi Elastic community.

Hope every one is doing well.

I really need your help, I couldn't understand how the ignore_older works in filebeat.

i will explain my doubt , below is the line of command how i kept in Filebeat.yml file,

scan_frequency: 10s
ignore_older: 24h
close_inactive: 72h
compression_level: 0
close_renamed: true	
close_removed: true
clean_removed: true 

my filebeat ,logstash and elastic search are up and running fine.

now i will down the filebeat and will keep the ignore command and run the services

If i keep below 24hrs file in input then it is passing to logstash and loading in elastic.

If i keep above 24hrs file i,e daybefore yesterday and yesterday file then it is also loading fine in elastic.
How it is possible if i kept ignore_older: 24h then is should ignore 24hrs above file it is not ignoring. Please explain me how it works.

If there is any alternate approach to ignore the old files please guide me.
Thanks in advance.

```

---

<div class="post-metadata">

**Author:** ![amjad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amjad/32/140039_2.png) [@amjad](https://discuss.elastic.co/u/amjad)\
**Post date:** [March 5, 2024, 6:26am UTC](https://discuss.elastic.co/t/filebeat-ignore-command/354637/2 "2024-03-05T06:26:05Z")

</div>

Hi All,

Can any one help me in this.

---

<div class="post-metadata">

**Author:** ![Ljapunov](https://avatars.discourse-cdn.com/v4/letter/l/f4b2a3/32.png) [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\
**Post date:** [March 5, 2024, 8:38am UTC](https://discuss.elastic.co/t/filebeat-ignore-command/354637/3 "2024-03-05T08:38:13Z")

</div>

Hi @amjad,

I do not exactly understand your explanation of what you are doing. What comes to my mind is that the `ignore_older` works on the timestamp of files. Can you show more of your setup and include the timestamps of the logfiles you are reading with filebeat?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2024, 8:38am UTC](https://discuss.elastic.co/t/filebeat-ignore-command/354637/4 "2024-04-02T08:38:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.