# Filebeat Lost of first lines when rotating files
**URL:** https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150
**Category:** Beats
**Tags:** filebeat
**Created:** [November 27, 2024, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150 "2024-11-27T15:55:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Florian\_Bahu](https://discuss.elastic.co/u/Florian_Bahu)
#### Post date: [November 27, 2024, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150/1 "2024-11-27T15:55:23Z")
Hello,
I noticed some issues when Filebeat reads a new file: the first line is sometimes skipped. So I made a quick script to test this:
```auto
#/bin/bash
for i in {00..100}; do
mv toto.log toto.log.${i} && touch toto.log
echo "test line" >> toto.log
sleep 2
done
```
I expect to have 101 lines in my Logstash output, but I get a random number of lines. Here is my Filebeat configuration:
```auto
path.home: /home/user
path.logs: ${path.home}/logs
path.data: ${path.home}/data
path.config: ${path.home}
logging.level: debug
logging.to_files: true
logging.files:
path: ${path.logs}
name: filebeat
keepfiles: 7
permissions: 0640
filebeat.inputs:
- type: filestream
id: test-stream
enabled: true
paths:
- /root/toto*.log
tags:
- testing
ignore_older: 48h
fields_under_root: true
scan_frequency: "1s"
close.on_state_change.renamed: true
output.logstash:
hosts: ["ipAddress:5044"]
bulk_max_size: 0
```
My Filebeat version is 8.16.1. I tried adjusting some parameters, but nothing changed. Does anyone have any idea what's happening and how I can solve my problem?
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 27, 2024, 7:19pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150/2 "2024-11-27T19:19:41Z")
> [@Florian\_Bahu](#):
>
> `close.on_state_change.renamed`
this setting causes Filebeat to stop reading files once they have been renamed
> When this option is enabled, Filebeat closes the file handler when a file is renamed. This happens, for example, when rotating files. By default, the harvester stays open and keeps reading the file because the file handler does not depend on the file name. If the `close.on_state_change.renamed` option is enabled and the file is renamed or moved in such a way that it’s no longer matched by the file patterns specified for the , the file will not be picked up again. Filebeat will not finish reading the file.
Try setting that to false
---
### Author:  [@Florian\_Bahu](https://discuss.elastic.co/u/Florian_Bahu)
#### Post date: [November 28, 2024, 10:09am UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150/3 "2024-11-28T10:09:39Z")
It doesn't seem to have any effect on the result. I still get a random number of lines in my Logstash output.
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 28, 2024, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150/4 "2024-11-28T14:15:27Z")
During file rotation, you are renaming the log files to a name that is not part of the glob you've given to filebeat: `.log.#` vs `*.log`
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 28, 2024, 2:19pm UTC](https://discuss.elastic.co/t/filebeat-lost-of-first-lines-when-rotating-files/371150/5 "2024-11-28T14:19:01Z")
> [@Florian\_Bahu](#):
>
> `bulk_max_size: 0`
> `scan_frequency: 1s`
Also worth noting that these two settings will have a negative performance impact and should likely be removed before moving this into production