# Filebeat sends old logs after reboot
**URL:** https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517
**Category:** Beats
**Tags:** filebeat
**Created:** [July 1, 2016, 8:15am UTC](https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517 "2016-07-01T08:15:59Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@lkosz](https://discuss.elastic.co/u/lkosz)
#### Post date: [July 1, 2016, 8:15am UTC](https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517/1 "2016-07-01T08:15:59Z")
I'm having problem with filebeat - filebeat send old logs after service restart. I've turned on debugging and got:
> 2016-07-01T09:42:45+02:00 INFO Additional configs loaded from: /etc/filebeat/conf.d/maillog.yml
> 2016-07-01T09:42:45+02:00 DBG File Configs: [/var/log/maillog]
> 2016-07-01T09:42:45+02:00 DBG scan path /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Check file for harvesting: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Start harvesting unknown file: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Resuming harvester on a previously harvested file: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Registrar will re-save state for /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG scan path /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Check file for harvesting: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Update existing file for harvesting: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG Not harvesting, file didn't change: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG harvest: "/var/log/maillog" position:19453749 (offset snapshot:0)
> 2016-07-01T09:42:45+02:00 INFO Harvester started for file: /var/log/maillog
> 2016-07-01T09:42:45+02:00 DBG End of file reached: /var/log/maillog; Backoff now.
next many:
> 2016-07-01T09:42:45+02:00 DBG full line read
and then I see old logs published (with current logs also). In registry file offset was set to non-zero value for this file. I have something wrong in configuration or is it bug in filebeat?
My config:
> **/etc/filebeat/filebeat.yml**
> filebeat:
> spool\_size: 2048
> publish\_async: false
> idle\_timeout: 5s
> registry\_file: /var/lib/filebeat/registry
> config\_dir: /etc/filebeat/conf.d
> output:
> logstash:
> hosts:
> - c.y:5044
> - d.y:5044
> loadbalance: true
> index: logstash
> shipper:
> name: a.b
> logging:
> to\_syslog: false
> to\_files: true
> ```
> files:
> path: /var/log/filebeat
> name: filebeat.log
> keepfiles: 7
>
> ```
> ```
> level: warning
>
> ```
> **/etc/filebeat/conf.d/maillog.yml**
> filebeat:
> prospectors:
> - paths:
> - /var/log/maillog
> encoding: plain
> fields\_under\_root: false
> input\_type: log
> ignore\_older: 5m
> close\_older: 5m
> document\_type: maillog
> scan\_frequency: 1s
> harvester\_buffer\_size: 16384
> tail\_files: false
> force\_close\_files: false
> backoff: 1s
> max\_backoff: 10s
> backoff\_factor: 2
> partial\_line\_waiting: 5s
> max\_bytes: 8192
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2016, 8:16am UTC](https://discuss.elastic.co/t/filebeat-sends-old-logs-after-reboot/54517/2 "2016-07-22T08:16:00Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.