# Filebeat is resending all data

**URL:** https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652
**Category:** Beats
**Tags:** filebeat
**Created:** [April 7, 2016, 9:40am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652 "2016-04-07T09:40:51Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![NiteshBarnwal](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)
#### Post date: [April 7, 2016, 9:40am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652/1 "2016-04-07T09:40:51Z")

</div>

I have one query regarding the data pushed by filebeat to logstash.

When I am opening and saving the log file, filebeat is resending all the data from the begining of the log. Is this the expected behaviour ? How can we overcome this?

When I am pushing one line without opening the file, it is working fine by sending the new data only. but resending all data when i am writting one line by opening the log file.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 7, 2016, 11:41am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652/2 "2016-04-07T11:41:00Z")

</div>

filebeat stores inode to identify files. If your editors saving strategy changes inode we have a hard time to tell wether the file has already been processed or not.

---

<div class="post-metadata">

### Author: ![NiteshBarnwal](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)
#### Post date: [April 8, 2016, 8:26am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652/3 "2016-04-08T08:26:10Z")

</div>

This was not the case in LSF. I am trying to migrate LSF to filebeat. Is there any way to overcome this issue in filebeat?

My configuration are at my previous post [Migration of LSF to filebeat](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493)

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 8, 2016, 10:57am UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652/4 "2016-04-08T10:57:48Z")

</div>

filebeat code base is derived from LSF code-base. As I don't fully understand what's happening I will need some output to figure out what's going on on OS level.

Which operating system are you using? filebeat version?

Can you run filebeat in debug mode `-v -d '*'` plus check inodes with `$ ls -i` ? Compare inode with inode in registry file.

Please add all output.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-is-resending-all-data/46652/5 "2017-07-05T21:53:36Z")

</div>


