# How log stash is recognizing file rotation and resetting byte offset in since db files of that file

**URL:** <https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514>\
**Category:** Logstash\
**Created:** [November 25, 2015, 6:27am UTC](https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514 "2015-11-25T06:27:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [November 25, 2015, 6:27am UTC](https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514/1 "2015-11-25T06:27:06Z")

</div>

currently i have a data.log file from which log stash is reading data continuously, after some one lakh lines i am moving this data to data1.log and adding some 100 lines of data into new data.log file. How does log stash is recognizing this change in data.log file and reading this new 100 lines of data. As byte offset in sincedb file corresponding to data.log will be pointing to some bigger number corresponding to old one lakh lines. So how does log stash is recognizing file rotation and resetting byte offset in since db files of that file.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 25, 2015, 6:45am UTC](https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514/2 "2015-11-25T06:45:55Z")

</div>

> currently i have a data.log file from which log stash is reading data continuously, after some one lakh lines

Please keep in mind that "[lakh](https://en.wikipedia.org/wiki/Lakh)" is not a well-known term outside of India and neighboring countries.

> i am moving this data to data1.log and adding some 100 lines of data into new data.log file. How does log stash is recognizing this change in data.log file and reading this new 100 lines of data. As byte offset in sincedb file corresponding to data.log will be pointing to some bigger number corresponding to old one lakh lines. So how does log stash is recognizing file rotation and resetting byte offset in since db files of that file.

Logstash tracks file offsets via inode numbers and will recognize that the original path no longer points to the same inode. It'll read the old file one last time (until EOF), forget that file, and reopen the new file to start tracking its contents.

I'm not sure if it'll read the new file from the beginning (which it should) or if it'll pay attention to the `start_position` option. In the latter case there would be a race condition where messages could be lost.

---

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [November 25, 2015, 9:02am UTC](https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514/3 "2015-11-25T09:02:13Z")

</div>

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/how-log-stash-is-recognizing-file-rotation-and-resetting-byte-offset-in-since-db-files-of-that-file/35514/4 "2017-07-06T05:21:20Z")

</div>