# Get last modification timestamp of file

**URL:** <https://discuss.elastic.co/t/get-last-modification-timestamp-of-file/370477>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 13, 2024, 1:58pm UTC](https://discuss.elastic.co/t/get-last-modification-timestamp-of-file/370477 "2024-11-13T13:58:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 13, 2024, 1:58pm UTC](https://discuss.elastic.co/t/get-last-modification-timestamp-of-file/370477/1 "2024-11-13T13:58:22Z")

</div>

is there a way I can only get modified timestamp of a file and sent out via filebeat?

What I need is from dir like this "/dir1/dir\*/\*.log" send modification time of this log file every few min to kafka.

multiple dir will be will be deleted and created at dir\* location.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [November 14, 2024, 10:21am UTC](https://discuss.elastic.co/t/get-last-modification-timestamp-of-file/370477/2 "2024-11-14T10:21:29Z")

</div>

You could use the auditd package on Linux to "watch" that location and combine it with the [auditd module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html) to actually ingest the data into elasticsearch.

Another option is to use [auditbeat with the fim module](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html)

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 14, 2024, 2:45pm UTC](https://discuss.elastic.co/t/get-last-modification-timestamp-of-file/370477/3 "2024-11-14T14:45:48Z")

</div>

Thank you that is what I was looking for. I just run simple test by installing and running it. it works. But it also picks up many other dir. It may be just configuration thing which I will figure out.