# Get latest log file

**URL:** <https://discuss.elastic.co/t/get-latest-log-file/48089>\
**Category:** Logstash\
**Created:** [April 21, 2016, 6:33pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089 "2016-04-21T18:33:02Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![impiyush](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/impiyush/32/9338_2.png) [@impiyush](https://discuss.elastic.co/u/impiyush)\
**Post date:** [April 21, 2016, 6:33pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/1 "2016-04-21T18:33:02Z")

</div>

I am trying to get logs from a SQL Server DB into ElasticSearch using LogStash. All the setup works fine and I am also able to see the logs in ES.  
As the DB is updated periodically, so I want to get the latest logs on an hourly basis from it without getting all the previous logs. Is there a way to do this in LogStash, i.e., getting logs based on a time-range?

Any help is really appreciated.

Thanks!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 21, 2016, 7:07pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/2 "2016-04-21T19:07:33Z")

</div>

Logstash tracks this for you automatically. You probably only need to make a small adjustment to your SQL query. See the [State section in the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-jdbc.html#_state) and the example further down in the docs that uses the `sql_last_value` parameter.

---

<div class="post-metadata">

**Author:** ![impiyush](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/impiyush/32/9338_2.png) [@impiyush](https://discuss.elastic.co/u/impiyush)\
**Post date:** [April 21, 2016, 9:17pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/3 "2016-04-21T21:17:20Z")

</div>

Thanks for quick response! looks like this did the job.

---

<div class="post-metadata">

**Author:** ![impiyush](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/impiyush/32/9338_2.png) [@impiyush](https://discuss.elastic.co/u/impiyush)\
**Post date:** [April 21, 2016, 10:48pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/4 "2016-04-21T22:48:10Z")

</div>

@magnusbaeck: I'm trying to schedule a logstash job for every 2 mins but it is not working. The scheduler does not work at all. It would be really helpful if you could review the below code and tell me what I'm doing wrong.

```
input {
    jdbc {
    # SQLServer jdbc connection string to our database
    jdbc_connection_string => " ****"

    #DB credentials
    jdbc_user => " ****"
    jdbc_password => " ****"

    # The path to our downloaded jdbc driver
    jdbc_driver_library => "path/sqljdbc/enu/sqljdbc41.jar"

    # The name of the driver class for SQL Server
    jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"

    # SQL query to execute
    statement => "SELECT Id,
            Status,
            Completed
    FROM Table
    WHERE Completed > :sql_last_value"

    #schedule updates
    schedule => "2 * * * *"
}
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 22, 2016, 5:53am UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/5 "2016-04-22T05:53:35Z")

</div>

The schedule `2 * * * *` means "run every hour, two minutes past the hour", i.e. 01:02, 02:02, 03:02, ... Use `*/2 * * * *` instead.

---

<div class="post-metadata">

**Author:** ![impiyush](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/impiyush/32/9338_2.png) [@impiyush](https://discuss.elastic.co/u/impiyush)\
**Post date:** [April 22, 2016, 4:23pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/6 "2016-04-22T16:23:50Z")

</div>

Thanks @magnusbaeck. You are awesome!! 🙂

---

<div class="post-metadata">

**Author:** ![impiyush](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/impiyush/32/9338_2.png) [@impiyush](https://discuss.elastic.co/u/impiyush)\
**Post date:** [April 26, 2016, 4:20pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/7 "2016-04-26T16:20:48Z")

</div>

@magnusbaeck: another quick question - if I use this schedule for logstash and then close my ssh access to the server, will this process be still running in the background? If not, is there a way to do something like this?

Thanks in advance!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 26, 2016, 4:47pm UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/8 "2016-04-26T16:47:55Z")

</div>

> if I use this schedule for logstash and then close my ssh access to the server, will this process be still running in the background?

No, it'll get a SIGHUP signal and shut down when you close your connection.

> If not, is there a way to do something like this?

Run Logstash as a daemon. The Debian and RPM packages provide scripts and configuration files for this. Consult your operating system documentation for details.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/get-latest-log-file/48089/9 "2017-07-06T05:00:29Z")

</div>