# Filebeat not indexing files immediately, have to make changes to files for it to get sent

**URL:** <https://discuss.elastic.co/t/filebeat-not-indexing-files-immediately-have-to-make-changes-to-files-for-it-to-get-sent/347468>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 19, 2023, 8:07am UTC](https://discuss.elastic.co/t/filebeat-not-indexing-files-immediately-have-to-make-changes-to-files-for-it-to-get-sent/347468 "2023-11-19T08:07:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ahmed\_Faisal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_faisal/32/121876_2.png) [@Ahmed\_Faisal](https://discuss.elastic.co/u/Ahmed_Faisal)\
**Post date:** [November 19, 2023, 8:07am UTC](https://discuss.elastic.co/t/filebeat-not-indexing-files-immediately-have-to-make-changes-to-files-for-it-to-get-sent/347468/1 "2023-11-19T08:07:39Z")

</div>

I am an ELK newbie. I have created some text files using a python script and saved them in a folder. I have configured Filebeat to send to Logstash and Logstash to Elasticsearch. I have set the path as

`- /home/vboxuser/temp/output_text_files2/*.txt`

My problem is that when i start filebeat and logstash, it does not immediately send the files. Once I enter the file, do anything in it (not changing the final file) and save it, then it gets indexed. Why do I need to save it once again for it to be sent? Also I do not even know if it is an filebeat problem or logstash problem. I tried using the ignore\_older: 1m option, I tried using scan\_frequency:1m option, still does not work.

Any or all help is appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2023, 10:07am UTC](https://discuss.elastic.co/t/filebeat-not-indexing-files-immediately-have-to-make-changes-to-files-for-it-to-get-sent/347468/2 "2023-12-17T10:07:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
