# Grabbing logs no older than X from randomly created logs

**URL:** <https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 22, 2016, 1:02pm UTC](https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257 "2016-09-22T13:02:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jziemba](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@jziemba](https://discuss.elastic.co/u/jziemba)\
**Post date:** [September 22, 2016, 1:02pm UTC](https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257/1 "2016-09-22T13:02:27Z")

</div>

I am new to the ELK stack and my issue is that I am using Filebeat to grab logs from one of the servers that we have, however we only want to see logs that are 14 days old or newer. The logs that we are looking at don't seem to be created any special way, as in we have one from today, one from yesterday, then one from August, they're randomly generated it seems. Each log file's lines are dated 20160922, today's date, and they go back as far as the previous file.

Is there a simple way to filter out what files get grabbed and indexed? and then what lines are grabbed and indexed? and lastly it seems as though filebeat isn't incrementally grabbing files but indexing all files everyday, is there a way to change that?

I appreciate any help/ideas!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2016, 1:02pm UTC](https://discuss.elastic.co/t/grabbing-logs-no-older-than-x-from-randomly-created-logs/61257/2 "2016-10-13T13:02:37Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.