# How logstash come to know about new entries in log file

**URL:** <https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983>\
**Category:** Logstash\
**Created:** [February 15, 2018, 12:45pm UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983 "2018-02-15T12:45:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shahidg](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@shahidg](https://discuss.elastic.co/u/shahidg)\
**Post date:** [February 15, 2018, 12:45pm UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983/1 "2018-02-15T12:45:49Z")

</div>

I am thinking to use logstash, but I have a question that how log stash come to know about the latest entries in log file ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2018, 1:56pm UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983/2 "2018-02-15T13:56:06Z")

</div>

The file's modification time is checked (by default every second).

---

<div class="post-metadata">

**Author:** ![shahidg](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@shahidg](https://discuss.elastic.co/u/shahidg)\
**Post date:** [February 16, 2018, 5:40am UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983/3 "2018-02-16T05:40:21Z")

</div>

ok , but what about content of file ? @magnusbaeck please can u explain the behavior of logstash with respect to log files etc ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 7:22am UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983/4 "2018-02-16T07:22:42Z")

</div>

If the file's modification time has changed Logstash will attempt to read from it. It reads until it hits the end of the file.

Is there any particular reason your asking these questions? We might be able to save some time if we address the root issue right away.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2018, 7:22am UTC](https://discuss.elastic.co/t/how-logstash-come-to-know-about-new-entries-in-log-file/119983/5 "2018-03-16T07:22:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.