# Get file's last modification date

**URL:** <https://discuss.elastic.co/t/get-files-last-modification-date/83234>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 21, 2017, 4:48pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234 "2017-04-21T16:48:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\
**Post date:** [April 21, 2017, 4:48pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/1 "2017-04-21T16:48:54Z")

</div>

Hi all,

Is there anyway to retrieve and output file's last modification date with filebeat ?

Thank you.

---

<div class="post-metadata">

**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\
**Post date:** [April 24, 2017, 4:26pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/2 "2017-04-24T16:26:51Z")

</div>

Really no idea ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 24, 2017, 7:14pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/3 "2017-04-24T19:14:05Z")

</div>

This is currently not possible with filebeat. Perhaps you can share your use case?

---

<div class="post-metadata">

**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\
**Post date:** [April 25, 2017, 6:59am UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/4 "2017-04-25T06:59:50Z")

</div>

Thanks for answering, I was feeling lonely !

Our use case : we are indexing whole files. Each file is an event so only one document. And we do not have no date in the file content. We don't want to use the indexing timestamp because we are indexing "old" files and the indexing timestamp will not match the file's last modification date.

By the way, as you said it is not currently possible so we have to find another solution...

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 26, 2017, 12:55pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/5 "2017-04-26T12:55:46Z")

</div>

You could check if LS has a plugin for doing something like that.

---

<div class="post-metadata">

**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\
**Post date:** [April 26, 2017, 1:00pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/6 "2017-04-26T13:00:08Z")

</div>

> [@ruflin](#):
>
> You could check if LS has a plugin for doing something like that.

The problem is that LS does not have access to the files.  
I'll have a look to LS plugins but I think only Filebeat can provide this information.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 27, 2017, 3:16pm UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/7 "2017-04-27T15:16:30Z")

</div>

I meant using LS to also ingest the files. It would be possible to add the date on the filebeat side rather easy. Perhaps you can open a feature request for it? I'm a bit worried that it will add more data which most of the users will not needed. Definitively worth discussing.

---

<div class="post-metadata">

**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\
**Post date:** [May 2, 2017, 7:18am UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/8 "2017-05-02T07:18:07Z")

</div>

> [@ruflin](#):
>
> I meant using LS to also ingest the files

But LS is on a dedicated server and cannot access files. And we don't want to have specialized architectures depending on source files (dedicated LS for example).

I will try to open a feature request as you suggest.

We also have a fallback solution: there is a datetime in the file name. But we have many source files and each file has it own file name template with different date format... But we could achieve it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2017, 7:21am UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234/9 "2017-05-30T07:21:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
