# Filebeat not properly recognising truncated file

**URL:** <https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 7, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849 "2020-12-07T12:41:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mutt13y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mutt13y/32/74962_2.png) [@mutt13y](https://discuss.elastic.co/u/mutt13y)\
**Post date:** [December 7, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849/1 "2020-12-07T12:41:43Z")

</div>

in this post [Filebeat and truncated files](https://discuss.elastic.co/t/filebeat-and-truncated-files/63054)  
@ruflin states that filebeat will detect when a file is truncated and start reading again.

I am on beats7.10 and centos 7

We are going to move all our logging to move and hup but for now I have some applications where we are using copytruncate

I see the following behaviour. After the log file is truncated I see a few lines in elasticsearch but then the data stops.

I looked in /var/lib/filebeat/registry/filebeat/log.json

I found the file in question. The inode is correct but the log offset is greater than the current filesize. So I wonder if filebeats got confused when the file was truncated and is waiting for the old log offset

config includes

```auto
scan_frequency: 10s
ignore_older: 24h

```

also paths does not match the rotated file

I see this in the debug log which seems ominous bit I have no idea why it is not recognising the inputs if that is the case.

```auto
2020-12-07T12:27:07.001Z INFO [crawler] beater/crawler.go:71 Loading Inputs: 0
2020-12-07T12:27:07.001Z DEBUG [registrar] registrar/registrar.go:140 Starting Registrar
2020-12-07T12:27:07.001Z INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 0
2020-12-07T12:27:07.001Z INFO cfgfile/reload.go:164 Config reloader started
2020-12-07T12:27:07.001Z INFO cfgfile/reload.go:164 Config reloader started

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2021, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849/2 "2021-01-04T14:41:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.