# Filebeat loading whole csv again, if new entries are added

**URL:** <https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 24, 2021, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150 "2021-04-24T15:27:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\
**Post date:** [April 24, 2021, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/1 "2021-04-24T15:27:07Z")

</div>

Hi,

I am trying to send csv(remote server) to elasticsearch(local server). For this, I am using filebeat on remote server to send csv to logstash on local server.

logstash listens for beats and sends it to elastic.

This whole setup works, but when there are new values added to csv on remote side, I see all values are sent to elastic again.

For example,

There were 4 rows in csv. I will have 4 rows in elastic.  
If csv get updated to 6 rows, I will have 10 rows in elastic and not 6.

Please advise what am I missing.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 26, 2021, 3:47pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/2 "2021-04-26T15:47:11Z")

</div>

Without looking at your logs and configuration it is hard to say. But what you are describing it seems to me that the new lines are not appended to your CSV but a new file is created and replaced with the previous file. What is adding new lines to your CSV?

---

<div class="post-metadata">

**Author:** ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\
**Post date:** [April 26, 2021, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/3 "2021-04-26T16:00:31Z")

</div>

I am opening CSV, updating it, and saving it manually

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 27, 2021, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/4 "2021-04-27T13:12:19Z")

</div>

File editors do not append to existing files. But rather they create a new file, sometimes they even create a temp file with the new contents and then rename it to the original file name.

You should append to your file with e.g. `echo "my;new;line" >> my_file.csv`

---

<div class="post-metadata">

**Author:** ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\
**Post date:** [April 27, 2021, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/5 "2021-04-27T13:25:16Z")

</div>

Thanks a lot 🙂

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 27, 2021, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/6 "2021-04-27T13:25:50Z")

</div>

Alternatively, if you really want to update your file manually you can set `file_identity` to `path`: [Log input | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_file_identity_4)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2021, 3:26pm UTC](https://discuss.elastic.co/t/filebeat-loading-whole-csv-again-if-new-entries-are-added/271150/7 "2021-05-25T15:26:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
