# How can I config about reverse log

**URL:** https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116
**Category:** Beats
**Tags:** filebeat
**Created:** [July 23, 2018, 8:58am UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116 "2018-07-23T08:58:22Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ziserendexin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ziserendexin/32/33626_2.png) [@ziserendexin](https://discuss.elastic.co/u/ziserendexin)
#### Post date: [July 23, 2018, 8:58am UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116/1 "2018-07-23T08:58:22Z")

</div>

I have this kind of log:

> |2018/6/8|15:49:37|D|  
> |2018/5/8|14:49:37|C|  
> |2018/3/30|13:33:32|B|  
> |2018/3/28|12:26:08|A|

when a new msgline is added, this new msgline will add at start of logfile. Like this:

> |2018/7/8|16:49:37|E|  
> |2018/6/8|15:49:37|D|  
> |2018/5/8|14:49:37|C|  
> |2018/3/30|13:33:32|B|  
> |2018/3/28|12:26:08|A|

How can I config this type of log in filebeat?

At first, I find 'tail\_files' option. But it just start at end of file, and read down.

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [July 23, 2018, 10:21am UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116/2 "2018-07-23T10:21:31Z")

</div>

This use case is not supported by Filebeat. May I ask what application writes log lines like this?

---

<div class="post-metadata">

### Author: ![ziserendexin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ziserendexin/32/33626_2.png) [@ziserendexin](https://discuss.elastic.co/u/ziserendexin)
#### Post date: [July 23, 2018, 4:02pm UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116/3 "2018-07-23T16:02:45Z")

</div>

how about logstash?

actully, i dont know...it's an industrial device,we just have log....😭

at last,only write it by myself...🙃

in other way, i think it is not too difficult to achieve this case...  
just modify offset to "eof - recorded offset "...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2018, 4:04pm UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116/4 "2018-08-20T16:04:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.