# Force logstash+FILEBEAT to reindex csv file
**URL:** https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219
**Category:** Beats
**Tags:** filebeat
**Created:** [January 29, 2019, 6:14pm UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219 "2019-01-29T18:14:49Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Aralex](https://discuss.elastic.co/u/Aralex)
#### Post date: [January 29, 2019, 6:14pm UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/1 "2019-01-29T18:14:49Z")
Hi,
I'm trying to do the same as in this post:
> [@Force logstash to reindex csv files](https://discuss.elastic.co/t/force-logstash-to-reindex-csv-files/55702):
>
> Hello, Sometimes I need to force the re-indexing of files csv from the beginning. I try to delete the sincedb file and restart logstash, but re-indexing never restart from the beginning. What is the solution to reindex all files with logstash ? Thanks.
except a big difference: the solution in the post above is using only logstash, while my pipeline ships data using filebeat to logstash. The file input plugin of logstash has the necessary parameters (sincedb\_path and ignore\_older). The csv filter of logstash doesn't have these. I checked the documentation, it seems like the beats input of logstash doesn't have these parameters either.
What can I do here?...
Thank you.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [January 30, 2019, 9:02am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/2 "2019-01-30T09:02:53Z")
So if I understood correctly you would like to read a CSV file using Filebeat. Then forward the events to Logstash and parse it.
You can use the `log` input of Filebeat to read the logs. Set the output to Logstash. Then Logstash can read from its `beats` input and parse the CSV it has received.
See more about `log`: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html)
To force Filebeat to reread files it has already encountered, you need to delete the appropiate entries from its registry file. This file is located under your data folder.
---
### Author:  [@Aralex](https://discuss.elastic.co/u/Aralex)
#### Post date: [January 30, 2019, 11:06am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/4 "2019-01-30T11:06:47Z")
Hi kvch, thank you for the reply.
My pipeline is already up and running nicely: filebeat monitors a folder for all csv files, ships data to logstash where data is parsed and filtered, then sent to ES.
When an entry in a csv file has its value modified, I want the pipeline to reread it and reindex it in ES. I read everything I found on reindexing. The problen is, as far as I found this is a highly manual task done through the dev section in kibana using PUT.
I don't prefer doing it this way, nor deleting entries in the registry. Once a csv entry is modified I need the changes to be reflected in my kibana dashboard. This is critical for my work.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 1, 2019, 9:04am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/5 "2019-02-01T09:04:41Z")
I am afraid that it is a use case we are not supporting. Filebeat is not able to detect whether a line in a file has been modified or not. It only reads each line once (unless the entries from the registry are deleted, in this case the whole file is reread and resent).
---
### Author:  [@Aralex](https://discuss.elastic.co/u/Aralex)
#### Post date: [February 7, 2019, 8:41am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/6 "2019-02-07T08:41:57Z")
There has to be a way. Do you intend to do something about this situation in a (near) future release?
We need to use filebeat, filter data in logstash using the csv filter, and have a method to rewrite/reindex entries upon any entry changes in the csv.
Please help, any additional info is highly appreciated
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 7, 2019, 10:36am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/7 "2019-02-07T10:36:27Z")
We are not planning to support this use case. The architecture of Filebeat reader pipeline does not support processing files in this manner. So even if we decide to support it (which I doubt), it is going to be a massive undertaking, as the core of Filebeat is was not designed in this way.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [February 7, 2019, 10:37am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/8 "2019-02-07T10:37:41Z")
You could try opening an enhancement request on Github so it is recorded somewhere. But it might get rejected there.
---
### Author:  [@Aralex](https://discuss.elastic.co/u/Aralex)
#### Post date: [February 7, 2019, 10:42am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/9 "2019-02-07T10:42:33Z")
ok, I'll try to do that.
I'm sure someone else at some point faced the same scenario and had the same question in mind.
This actually became a new requirement in our pipeline, which is why we went with filebeat and not directly with logstash.
Thank you for the reply. I'll see if there's a workaround and post any updates.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2019, 10:42am UTC](https://discuss.elastic.co/t/force-logstash-filebeat-to-reindex-csv-file/166219/10 "2019-03-07T10:42:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.