# Filebeat processing file the rsynced file always from the beginning

**URL:** <https://discuss.elastic.co/t/filebeat-processing-file-the-rsynced-file-always-from-the-beginning/233758>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 21, 2020, 2:49pm UTC](https://discuss.elastic.co/t/filebeat-processing-file-the-rsynced-file-always-from-the-beginning/233758 "2020-05-21T14:49:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\
**Post date:** [May 21, 2020, 2:49pm UTC](https://discuss.elastic.co/t/filebeat-processing-file-the-rsynced-file-always-from-the-beginning/233758/1 "2020-05-21T14:49:12Z")

</div>

Hi,

I have a log file which will be rsynced from another server(source server) using a different user ID (user 1). In the current sever(destination server) I'm running filebeat agen as a different user(user 2) User 2 and user 1 belonged to the same linux user group. The rsynced log file in destination server has read permission to the group, so filebeat user only has the read permission fpr the file. In this set up I have observed that filebeat agemt is reading the log file from the beginning for every rsync execution.

I didnt observe this behavior when I use owner(user1) of the log file and run the filebeat agent.

Any idea on this? Appreciate any thoughts or suggestions

Filebeat version - 7.4.0  
Running on linux

Thanks

---

<div class="post-metadata">

**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\
**Post date:** [May 27, 2020, 4:59am UTC](https://discuss.elastic.co/t/filebeat-processing-file-the-rsynced-file-always-from-the-beginning/233758/2 "2020-05-27T04:59:17Z")

</div>

Any thoughts on this?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2020, 4:59am UTC](https://discuss.elastic.co/t/filebeat-processing-file-the-rsynced-file-always-from-the-beginning/233758/3 "2020-06-24T04:59:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.