# How file beat handles the case if log files were replaced?

**URL:** <https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 12, 2017, 5:03am UTC](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152 "2017-09-12T05:03:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![padmajav9](https://avatars.discourse-cdn.com/v4/letter/p/e95f7d/32.png) [@padmajav9](https://discuss.elastic.co/u/padmajav9)\
**Post date:** [September 12, 2017, 5:03am UTC](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152/1 "2017-09-12T05:03:31Z")

</div>

Hi,

In my project, i have a requirement where we download logs from the devices on an hourly basis, unzip and push to elastic search. After every download, we are replacing the existing files. is file beat keep track of the last pushed pointer if the file got replaced? How do we achieve this with filebeat? Thanks for your help in advance!

Thx!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 12, 2017, 5:36am UTC](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152/2 "2017-09-12T05:36:04Z")

</div>

Filebeat tracks files based on node (at least on Linux), which means that as long as you append to an existing file it keeps track of what has been processed. If you however replace the file, it will appear as a new file and be parsed from the beginning.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2017, 5:36am UTC](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152/3 "2017-10-10T05:36:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.