# Filebeat reads the complete log file from start

**URL:** <https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 6, 2018, 11:31am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629 "2018-02-06T11:31:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Punit\_Bangade](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Punit\_Bangade](https://discuss.elastic.co/u/Punit_Bangade)\
**Post date:** [February 6, 2018, 11:31am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629/1 "2018-02-06T11:31:15Z")

</div>

Hello,  
I am using filebeat version 5.6.0,in my log file location I am copying log files from remote machine.If the file already exist in my local directory i am replacing it with newer one after some time interval.  
But if i see my filebeat is reading the file from the start instead of the last modified location.  
Can you please help me understand is it the proper behavior and is there any way to resolve the issue

Thanks

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [February 6, 2018, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629/2 "2018-02-06T18:35:00Z")

</div>

Hi @Punit_Bangade,

By replacing the file Filebeat understands it's a new one, and sends it again. Is there any way you can update the existing file by appending the new lines?

---

<div class="post-metadata">

**Author:** ![Punit\_Bangade](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Punit\_Bangade](https://discuss.elastic.co/u/Punit_Bangade)\
**Post date:** [February 7, 2018, 4:25am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629/3 "2018-02-07T04:25:42Z")

</div>

Hello @exekias  
Actually my application logs are on remote Solaris and i guess Filebeat don't support on Solaris,that's why I am copying those log fie from Solaris to local windows machine and then reading them.I am not sure what can be done in this scenario.  
Can you please suggest something that will help us to overcome the situation

Thanks

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [February 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629/4 "2018-02-08T11:21:00Z")

</div>

Hi @Punit_Bangade,

If you are using a tool like `rsync`, you can ask it to append new lines to the existing files, that way Filebeat won't treat them as new, and will pick only the new lines. The way to do it when using `rsync` is passing the `--append` flag.

Best regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629/5 "2018-03-08T11:21:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.