# Filebeat loses first lines when file rotated
**URL:** https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655
**Category:** Beats
**Tags:** filebeat
**Created:** [March 14, 2023, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655 "2023-03-14T12:28:58Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)
#### Post date: [March 14, 2023, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655/1 "2023-03-14T12:28:58Z")
We have discovered that filebeat loses first lines when file rotated.
For example we use the following config to get auditbeat logs and when file rotated (auditbeat restarted) we see that first lines missing (written in first 10 seconds = scan\_frequency).
```auto
- type: filestream
id: auditbeat-logs
enabled: true
paths:
- /var/log/auditbeat/auditbeat-*.ndjson
```
Seems like filebeat uses [tail\_files](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_tail_files_2) strategy and I'm wondering how we can change this behavior and force it to read new files from the beginning.
We have checked all options and read all topics and posts like [Log rotation results in lost or duplicate events](https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html#file-log-rotation)
This issue make filebeat not reliable solution.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2023, 2:29pm UTC](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655/2 "2023-04-11T14:29:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.