# How to figure out at which line Logstash is in a file?

**URL:** https://discuss.elastic.co/t/how-to-figure-out-at-which-line-logstash-is-in-a-file/116759
**Category:** Logstash
**Created:** [January 23, 2018, 9:57pm UTC](https://discuss.elastic.co/t/how-to-figure-out-at-which-line-logstash-is-in-a-file/116759 "2018-01-23T21:57:13Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![padakwaak](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@padakwaak](https://discuss.elastic.co/u/padakwaak)
#### Post date: [January 25, 2018, 6:15pm UTC](https://discuss.elastic.co/t/how-to-figure-out-at-which-line-logstash-is-in-a-file/116759/5 "2018-01-25T18:15:53Z")

</div>

I have extended that StackOverflow script quite a bit by obtaining the current position that Logstash has read from by using 'lsof'.

My script can be found here: [Logstash Progress - Pastebin.com](https://pastebin.com/qsjYKd5W)  
You'll have to modify the FILES\_TO\_BE\_PARSED and SINCE\_DB\_FILES variables to point to the correct locations/format that your files are stored.

And example output of my script would look something like:

> \<% Complete\>   
> /var/log/remotelogs/imsigw-imsigw4.log 97.6% 1592548279 1553569508 524299  
> /var/log/remotelogs/ussdgw-ussdgw1.log 42.1% 6202389785 2612068352 524300  
> /var/log/remotelogs/imsigw-imsigw4.log.1 68.8% 1276445987 878379008 524307  
> /var/log/remotelogs/imsigw-imsigw3.log 93.8% 1592752501 1494754037 524310  
> /var/log/remotelogs/ussdgw-ussdgw7.log 96.8% 4588987770 4441003272 524701  
> /var/log/remotelogs/ussdgw-ussdgw1.log.1 40.6% 5152213263 2092012450 524298  
> /var/log/remotelogs/imsigw-imsigw3.log.1 100.0% 1278359148 1278359148 524304  
> /var/log/remotelogs/ussdgw-ussdgw7.log.1 80.0% 3830505584 3066234297 524308  
> Total Summary: 17416380072/25514202317 = 68.3%

I am currently using this script within the sebp/elk docker container, but I had to install 'lsof' first.

I really hope that the issue with regards to the sincedb that has been raised multiple times would get addressed/fixed some time: [Sincedb not written when EOF not reached yet](https://discuss.elastic.co/t/sincedb-not-written-when-eof-not-reached-yet/116059)

---

_[View the full topic](https://discuss.elastic.co/t/how-to-figure-out-at-which-line-logstash-is-in-a-file/116759)._
