# How does filebeat keep track of what line it has read? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 24, 2018, 7:28am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086 "2018-05-24T07:28:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\ **Post date:** [May 24, 2018, 7:28am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/1 "2018-05-24T07:28:59Z")
If I have a log file that are x MB long, and there is a new log entry. How does FIlebeat know where it should start to read again? Does it need to retrieve the entire file, or does it open the file from its last known line? ---
**Author:** ![arkady\_renko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arkady_renko/32/30160_2.png) [@arkady\_renko](https://discuss.elastic.co/u/arkady_renko)\ **Post date:** [May 24, 2018, 8:34am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/2 "2018-05-24T08:34:13Z")
This topic can answer your questions. [https://www.elastic.co/guide/en/beats/filebeat/6.0/how-filebeat-works.html#\_how\_does\_filebeat\_keep\_the\_state\_of\_files](https://www.elastic.co/guide/en/beats/filebeat/6.0/how-filebeat-works.html#_how_does_filebeat_keep_the_state_of_files) ---
**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\ **Post date:** [May 24, 2018, 9:09am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/3 "2018-05-24T09:09:46Z")
I have already read that site arkady\_renko. But I didn't understand it. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 24, 2018, 11:25am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/4 "2018-05-24T11:25:00Z")
Filebeat stores the last read offset and when opening it will directly jump to this offset. ---
**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\ **Post date:** [May 24, 2018, 11:39am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/5 "2018-05-24T11:39:23Z")
But does it open the entire file? If the file is located at server B, but filebeat is located at server A. Does it then have to retrieve the entire file ? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 24, 2018, 1:23pm UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/6 "2018-05-24T13:23:02Z")
In general we don't recommend to read from a remote file system. What exactly happens I think does more depend on the OS and the Filesystem then Filebeat itself. Filebeat calls `seek` on the file handler and requests to start reading from that offset. ---
**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\ **Post date:** [May 25, 2018, 6:19am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/7 "2018-05-25T06:19:06Z")
Thanks ruflin. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 22, 2018, 6:19am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086/8 "2018-06-22T06:19:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.