# Filebeat sent duplicate events after the log file renamed - Windows

**URL:** <https://discuss.elastic.co/t/filebeat-sent-duplicate-events-after-the-log-file-renamed-windows/361706>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 19, 2024, 7:25am UTC](https://discuss.elastic.co/t/filebeat-sent-duplicate-events-after-the-log-file-renamed-windows/361706 "2024-06-19T07:25:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![petertw6235](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@petertw6235](https://discuss.elastic.co/u/petertw6235)\
**Post date:** [June 19, 2024, 7:25am UTC](https://discuss.elastic.co/t/filebeat-sent-duplicate-events-after-the-log-file-renamed-windows/361706/1 "2024-06-19T07:25:47Z")

</div>

hi,  
We found some duplicate events in Elasticsearch and those events were from the renamed log file.

Filebeat version : 7.17  
OS: Windows 2019 server

Here is the filebeat log:

```auto
2024-05-28T09:02:42.320+0800	INFO	[input.filestream]	filestream/input.go:321	Reader was closed. Closing.	{"id": "AED3DB69868B5069", "source": "filestream::.global::native::8716288-126642-177104865", "path": "D:\\FAB300\\Log\\csimweb_20240525.21.18.18.11_kcmes1_32168.log", "state-id": "native::8716288-126642-177104865"}
2024-05-28T09:11:03.658+0800	INFO	[input.filestream]	filestream/input.go:321	Reader was closed. Closing.	{"id": "AED3DB69868B5069", "source": "filestream::.global::native::8716288-126642-177104865", "path": "D:\\FAB300\\Log\\csimweb_20240525.21.18.18.11_kcmes1_32168.log", "state-id": "native::8716288-126642-177104865"}
2024-05-28T09:14:28.233+0800	INFO	[input.filestream]	filestream/input.go:321	Reader was closed. Closing.	{"id": "AED3DB69868B5069", "source": "filestream::.global::native::8716288-126642-177104865", "path": "D:\\FAB300\\Log\\csimweb_20240525.21.18.18.11_kcmes1_32168_20240528.09.11.03.63.log", "state-id": "native::8716288-126642-177104865"}

```

The file id "native::8716288-126642-177104865" was the same after the file rename.

Why Filebeat harvest the renamed log file again?  
Is the only way to prevent this situation is using fingerprint?