# Filebeat re-ingesting old logs after pod restart (ECK on GKE) - ignore\_older not working **URL:** \ **Category:** Elastic Cloud on Kubernetes (ECK)\ **Tags:** ilm-index-lifecycle-management\ **Created:** [January 1, 2026, 12:48am UTC](https://discuss.elastic.co/t/filebeat-re-ingesting-old-logs-after-pod-restart-eck-on-gke-ignore-older-not-working/384328 "2026-01-01T00:48:09Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [January 2, 2026, 6:56am UTC](https://discuss.elastic.co/t/filebeat-re-ingesting-old-logs-after-pod-restart-eck-on-gke-ignore-older-not-working/384328/2 "2026-01-02T06:56:45Z")
Hello @Marwan_Ghonem Welcome to the Community!! Could you please share the filebeat.yml in order to understand why the older indices are created again? It can be related to the registry path : > **[Configure general settings | Beats](https://www.elastic.co/docs/reference/beats/filebeat/configuration-general-options)** > > You can specify settings in the filebeat.yml config file to control the general behavior of Filebeat. This includes: Global options that control things... Similar older issue : > [@Filebeats(5.40) keeps on recreating the indices after deletion](https://discuss.elastic.co/t/filebeats-5-40-keeps-on-recreating-the-indices-after-deletion/121986): > > I have filebeats reading the log files on a remote server and shipping it to logstash on the same server. I have tried deleting the last 6 months old indices but I have noticed that indices are recreated on the elastic search. Can you correct me where i'm doing wrong I went with the default configuration. Thanks paths: #- /var/log/\*.log - \\webserver10\iislogs\*.log output.logstash: # Boolean flag to enable or disable the output module. #enabled: true # The Logstash hosts ho… Thanks!! --- _[View the full topic](https://discuss.elastic.co/t/filebeat-re-ingesting-old-logs-after-pod-restart-eck-on-gke-ignore-older-not-working/384328)._