# Filebeat read file from beginning always when restart

**URL:** <https://discuss.elastic.co/t/filebeat-read-file-from-beginning-always-when-restart/293325>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 3, 2022, 8:26am UTC](https://discuss.elastic.co/t/filebeat-read-file-from-beginning-always-when-restart/293325 "2022-01-03T08:26:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sc.lai](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@sc.lai](https://discuss.elastic.co/u/sc.lai)\
**Post date:** [January 3, 2022, 8:26am UTC](https://discuss.elastic.co/t/filebeat-read-file-from-beginning-always-when-restart/293325/1 "2022-01-03T08:26:03Z")

</div>

I have a problem with filebeat running on Linux, every time I stop the filebeat and then start it, it always read file from the beginning.

The log file uploaded by windows batch every 5 minutes, steps as below:

1. put temporary file

2. replace original file by renaming temporary file

Filebeat read the line from last change correctly, except restart.

Linux version: **Red Hat Enterprise Linux Server release 6.9 (Santiago)**  
Filebeat version: **7.16.2**

My **filebeat configuration**

```auto
filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /logs/AB*
  file_identity.path: ~   
  encoding: GB2312
  parsers:
  - multiline:
      type: pattern
      pattern: '^.*INFO'
      negate: true
      match: after
      flush_pattern: '.*Testing End.*'
      max_lines: 10000

output.kafka:
  hosts: ["192.168.1.1:9092"]
  topic: "filebeat-logs"
  enabled: true
  max_message_bytes: 10000000
  required_acks: 0

```

Is there any way to stop reading the log files again on restarting filebeat and thus avoiding duplicate logging?

---

<div class="post-metadata">

**Author:** ![hocho](https://avatars.discourse-cdn.com/v4/letter/h/8e7dd6/32.png) [@hocho](https://discuss.elastic.co/u/hocho)\
**Post date:** [January 4, 2022, 11:38am UTC](https://discuss.elastic.co/t/filebeat-read-file-from-beginning-always-when-restart/293325/2 "2022-01-04T11:38:23Z")

</div>

Could it be a permission issue? Are you running filebeat as root? It sounds like the user running the filebeat service cannot write to the filebeat registry file to be able to keep track where it left off before shutdown of the service.

> **[Configure general settings | Filebeat Reference \[7.16\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-general-options.html#_registry_file_permissions)**

What does your logs say or journalctl?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2022, 11:38am UTC](https://discuss.elastic.co/t/filebeat-read-file-from-beginning-always-when-restart/293325/3 "2022-02-01T11:38:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.