# Filebeat sending all data from file not just new line added

**URL:** <https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 8, 2020, 10:29pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215 "2020-04-08T22:29:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![NetRajan](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@NetRajan](https://discuss.elastic.co/u/NetRajan)\
**Post date:** [April 8, 2020, 10:29pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215/1 "2020-04-08T22:29:11Z")

</div>

I am bit puzzled why Filebeat is sending all file data when only one line is added. I am expecting to behave like tail -f and send only one newly added file

 ![Screen Shot 2020-04-08 at 3.28.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5dc7ddaa7347c8ebafe47310bfcd57407fdf0cf.png)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 9, 2020, 5:51am UTC](https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215/2 "2020-04-09T05:51:08Z")

</div>

How exactly are you adding the data? Filebeat expects the data to be appenddd so the inode of the file does not change. If you e.g. add data using an editor a new file with the same name but different inode is typically generated behind the scenes which would appear as a new file.

---

<div class="post-metadata">

**Author:** ![NetRajan](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@NetRajan](https://discuss.elastic.co/u/NetRajan)\
**Post date:** [April 9, 2020, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215/3 "2020-04-09T13:56:41Z")

</div>

Thanks Christian. Yes, I was using editor and as you mention new inode must be generated. Appreciate your timely help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2020, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-data-from-file-not-just-new-line-added/227215/4 "2020-05-07T13:56:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.