# How long will Logstash recollect data?

**URL:** <https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587>\
**Category:** Logstash\
**Created:** [March 30, 2017, 5:41am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587 "2017-03-30T05:41:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zhong\_Guan](https://avatars.discourse-cdn.com/v4/letter/z/e9bcb4/32.png) [@Zhong\_Guan](https://discuss.elastic.co/u/Zhong_Guan)\
**Post date:** [March 30, 2017, 5:41am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/1 "2017-03-30T05:41:07Z")

</div>

Hi,  
I ran logstash to collect log file from azure storage.  
I noticed logstash will start to collect log every hour?  
Is it true? Could you please tell me how to shorten it?  
Regards,  
Zhong

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 30, 2017, 5:45am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/2 "2017-03-30T05:45:24Z")

</div>

Which input plugin are you using? What does its configuration look like?

---

<div class="post-metadata">

**Author:** ![Zhong\_Guan](https://avatars.discourse-cdn.com/v4/letter/z/e9bcb4/32.png) [@Zhong\_Guan](https://discuss.elastic.co/u/Zhong_Guan)\
**Post date:** [March 30, 2017, 5:59am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/3 "2017-03-30T05:59:17Z")

</div>

I am using logstash-input-azureblob  
the config is  
input {  
azureblob {  
storage\_account\_name =\> "xxxx"  
storage\_access\_key =\> "xxxxxxx"  
container =\> "test1"  
}  
}  
filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:iisSite} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NOTSPACE:cookie} - %{NOTSPACE:referer} %{NUMBER:scstatus} %{NUMBER:sc-substatus} %{NUMBER:sc-win32-status} %{NUMBER:sc-bytes:int} %{NUMBER:cs-bytes:int} %{NUMBER:timetaken:int}"]  
}  
}  
output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}  
Question 1:  
My new log file will be created every hour on storage.  
I only can see logstash work at that time, and collect few data.  
As a result. I only can collect the log that occured at such as from 10:00:00 to 10:01:00.  
Question 2:  
If I want to recollect today's log. How should I do?

Regards,  
Zhong

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 30, 2017, 6:04am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/4 "2017-03-30T06:04:58Z")

</div>

Sorry, I'm not familiar with that plugin.

---

<div class="post-metadata">

**Author:** ![Zhong\_Guan](https://avatars.discourse-cdn.com/v4/letter/z/e9bcb4/32.png) [@Zhong\_Guan](https://discuss.elastic.co/u/Zhong_Guan)\
**Post date:** [March 30, 2017, 8:31am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/5 "2017-03-30T08:31:07Z")

</div>

If I want to collect data from azure storage, could you give me any advice?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2017, 8:31am UTC](https://discuss.elastic.co/t/how-long-will-logstash-recollect-data/80587/6 "2017-04-27T08:31:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.