# Filebeat's logs rotation malfunctioning
**URL:** https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522
**Category:** Beats
**Tags:** filebeat
**Created:** [August 2, 2017, 12:33pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522 "2017-08-02T12:33:48Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)
#### Post date: [August 2, 2017, 12:33pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/1 "2017-08-02T12:33:48Z")
Hi,
Below is my filebeat config:
```
filebeat.prospectors:
- input_type: log
paths:
- '/tmp/worker.log'
encoding: utf-8
output.logstash:
hosts: ["127.0.0.1:5044"]
worker: 2
loadbalance: true
ssl.verification_mode: none
ssl.certificate_authorities: ["/tmp/server.cert.pem"]
ssl.certificate: "/tmp/server.cert.pem"
ssl.key: "/tmp/server.key.pem"
logging.level: info
logging.metrics.enabled: true
logging.metrics.period: 30s
logging.to_files: true
logging.files:
path: /tmp/filebeatlogs
name: filebeat
rotateeverybytes: 104857600 # = 100MB
keepfiles: 10
```
Every time I restart I see two log files getting created.
```
-rw------- 1 root root 4023 Aug 2 15:21 filebeat
-rw------- 1 root root 57 Aug 2 15:13 filebeat.1
-rw------- 1 root root 3514 Aug 2 15:13 filebeat.2
-rw------- 1 root root 57 Aug 2 15:12 filebeat.3
-rw------- 1 root root 48579 Aug 2 15:10 filebeat.4
-rw------- 1 root root 57 Aug 2 10:10 filebeat.5
```
How to prevent this ? That small file always contains the following log.
```
2017-08-02T15:13:34+03:00 INFO Metrics logging every 30s
```
Is it because console is stopping for me to type sudo's password ?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 2, 2017, 7:30pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/2 "2017-08-02T19:30:23Z")
filebeat rotates the logs on every restart or when the limit is reached. Having two files being generated is kind of weird. Looks like filebeat is restarted 'twice' when you trigger a restart...
You have any other content in the second log file?
Which OS/distribution are you using.
---
### Author:  [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)
#### Post date: [August 7, 2017, 1:40pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/3 "2017-08-07T13:40:53Z")
Hi,
I am really sorry for the late reply.
> [@steffens](#):
>
> You have any other content in the second log file?
No, I don't have any other content in the second log file.
> [@steffens](#):
>
> Which OS/distribution are you using
The following is my `uname -a`
```
Linux abhiroyg 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
```
I think it is Ubuntu 16.04
I didn't test it further. But, from my current observation, it is happening whenever I had to enter password for sudo.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 7, 2017, 2:38pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/4 "2017-08-07T14:38:10Z")
sounds weird. You using `sudo systemctl restart filebeat`? Does the same happen if you stop the service and run filebeat in foreground `filebeat.sh` ?
---
### Author:  [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)
#### Post date: [August 8, 2017, 11:02am UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/5 "2017-08-08T11:02:52Z")
Oops. Sorry, no. I downloaded the tar.gz file and run the command `sudo ./filebeat -c filebeat.yml -httpprof :7000` to start filebeat.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 8, 2017, 1:06pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/6 "2017-08-08T13:06:06Z")
Which exact filebeat version are you using? Skimming the code, I suspect a potential race that might be triggered due to enabling `-httpprof`. This race might lead to files being rotated twice on startup.
Anyway, instead of rotation logs on every restart, we should also consider to change log rotation, to continue old files and only rotate once the configure size limit is reached.
---
### Author:  [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)
#### Post date: [August 8, 2017, 4:52pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/7 "2017-08-08T16:52:10Z")
Hi,
Thank you so much for taking that much pains! I am using 5.5.0 version.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2017, 4:55pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522/8 "2017-09-05T16:55:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.