# Filebeat loss log data

**URL:** <https://discuss.elastic.co/t/filebeat-loss-log-data/232158>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 12, 2020, 7:54am UTC](https://discuss.elastic.co/t/filebeat-loss-log-data/232158 "2020-05-12T07:54:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuqibin](https://avatars.discourse-cdn.com/v4/letter/y/e56c9b/32.png) [@yuqibin](https://discuss.elastic.co/u/yuqibin)\
**Post date:** [May 12, 2020, 7:54am UTC](https://discuss.elastic.co/t/filebeat-loss-log-data/232158/1 "2020-05-12T07:54:59Z")

</div>

Filebeat not collect file which has being marked inactived. But the file is always update intime.

We use filebeat to collect application's log to logstash.

config:

```auto
    filebeat.inputs:
      - type: log
        enabled: true
        paths:
          - /home/xxxlogs/logs/sys/*/*.log
          - /home/xxxlogs/logs/sys/*.log
        max_bytes: 1048576
        ignore_older: 168h
        multiline.pattern: '^20\d{2}'
        multiline.negate: true
        multiline.match: after
        multiline.max_lines: 500
        multiline.timeout: 5
    filebeat.config.modules:
      path: ${path.config}/modules.d/*.yml
      reload.enabled: false
      reload.period: 10s
    queue.mem:
      events: 200
      flush.min_events: 100
    output.logstash:
      hosts: ['x.x.x.x:5048']
      bulk_max_size: 100
    http:
      enabled: true
      host: localhost
      port: 5066

    # filebeat logs setting
    logging.level: info
    logging.to_files: true
    logging.files:
      path: /home/xxxlogs/applogs/filebeat
      name: filebeat.log
      keepfiles: 7
      permissions: 0644
      rotateeverybytesedit: 209715200

```

in filebeat-log:  
We found the log was be marked inactived after close\_inactive time .

```auto
2020-05-12T00:00:09.101+0800 INFO log/harvester.go:251 Harvester started for file: /home/xxxlogs/logs/sys/xxx/http-server.log"

2020-05-12T00:05:05.664+0800 INFO log/harvester.go:276 File is inactive: /home/xxxlogs/logs/sys/xxx/http-server.log. Closing because close_inactive of 5m0s reached.

```

_but actual file are always being updated..._

**After we restart the application.**  
**The log in file unexpectedly can be collected**. but the filebeat-log has no "Harvester started for file: " record.  
**No rotate log event occured！**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2020, 8:07am UTC](https://discuss.elastic.co/t/filebeat-loss-log-data/232158/2 "2020-06-09T08:07:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.