# Filebeat showing logs older than 24 hrs **URL:** \ **Category:** Beats\ **Created:** [June 13, 2016, 10:18pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668 "2016-06-13T22:18:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![filebeat\_win](https://avatars.discourse-cdn.com/v4/letter/f/7ba0ec/32.png) [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Post date:** [June 13, 2016, 10:18pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/1 "2016-06-13T22:18:21Z")
Hi All, On Windows, my filebeat.yml is set to ignore older than 24h, yet when I am running filebeat today, it is actually showing IIS logs from back in May. The IIS logs are configured to rollover each day, so I'm not sure what is causing this. Any thoughts? To further clarify, Kibana only shows entries for 5/26, although I just opened the IIS website from the server in question moments ago. A new IIS log file was created today, and several other IIS log files exist from different days, dating back to 2014. I am unsure why it chose to display log files from 5/24 only. ---
**Author:** ![filebeat\_win](https://avatars.discourse-cdn.com/v4/letter/f/7ba0ec/32.png) [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Post date:** [June 13, 2016, 10:28pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/2 "2016-06-13T22:28:11Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/2/28ef371017d85f16568a989997d64f9e253568a4.png) Screenshot attached of the IIS log directory, highlighting the file that some logs are pulling from. Note that not all log entries within the log file are showing in Kibana, only select ones. I do not see any logs pulled from previous days, or anything from today's log. This is running filebeat 1.2.3, and IIS has been restarted. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [June 14, 2016, 7:46am UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/3 "2016-06-14T07:46:51Z")
I'm not sure I can follow your description to 100%. Here is what I get: - You have ignore\_older set to 24h - In Kibana it shows correctly only the most recent files after harvesting? - Filebeat crawls more files (how did you spot that if they are not in Kibana)? Can you share your config file? ---
**Author:** ![filebeat\_win](https://avatars.discourse-cdn.com/v4/letter/f/7ba0ec/32.png) [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Post date:** [June 14, 2016, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/4 "2016-06-14T14:04:27Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/7/720dde374232ac6678c0639446b27b36f1d5ad59.png) So as of now (2:00 PM UTC), I the newest logs that I see are from 2016-06-14 at 00:00:00. Strangely when I sort by log\_timestamp they are out of order. The filebeat config: > filebeat: > prospectors: > paths: > - C:\inetpub\logs\LogFiles\*\* > - D:\logfiles\*\* > encoding: utf-8 > exclude\_lines: ["^#"] > exclude\_files: [".zip"] > ignore\_older: 24h > registry\_file: "C:/ProgramData/filebeat/registry" > output: > logstash: > hosts: ["elk:3525"] > compression\_level: 0 > logging: > files: > rotateeverybytes: 10485760 # = 10MB ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [June 15, 2016, 6:10am UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/5 "2016-06-15T06:10:03Z")
Are these two posts related / the same? [Filebeat Windows Config Help (filebeat.yml)](https://discuss.elastic.co/t/filebeat-windows-config-help-filebeat-yml/52656) ---
**Author:** ![filebeat\_win](https://avatars.discourse-cdn.com/v4/letter/f/7ba0ec/32.png) [@filebeat\_win](https://discuss.elastic.co/u/filebeat_win)\ **Post date:** [June 15, 2016, 1:24pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/6 "2016-06-15T13:24:22Z")
Yes - they are related. I will comment on the other one with more information. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2016, 10:18pm UTC](https://discuss.elastic.co/t/filebeat-showing-logs-older-than-24-hrs/52668/7 "2016-07-04T22:18:44Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.