# How to insert file,when my file is continuously updating **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 22, 2016, 10:23am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639 "2016-05-22T10:23:33Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 22, 2016, 10:23am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/1 "2016-05-22T10:23:33Z")
Hi, I am having 5 files, names of those files are xyz0.log ,xyz1.log,.....xyz4.log and in that file there is a text :"my name is tom". now I am runing filebeat its only give one output to me ,but it harvest to all file and not give all five as output why?It give only one file as output. When i change the text of my output file ,eg "my name is jerry" then it not update that output file and i not get single output. so my question is why it not show five output ,when it harvest five file,and my second question is that how i update my file.And get output ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2016, 7:25am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/2 "2016-05-23T07:25:14Z")
Filebeat does tail files, so it checks if content was append to the files. If the file length stays the same, it cannot detect changes. In your example above, I would expect filebeat to ship `ry` the first time you change it. Filebeat should tail all 5 files. Did you clean the registry file before "retesting"? Can you share your config file? ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:30am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/3 "2016-05-23T07:30:29Z")
yes, filebeat: # List of prospectors to fetch data. ## prospectors: paths: #- c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/_.log #- c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/_.err #- c:/Users/akashsoni/Downloads/k/Test/_.err #- c:/Users/akashsoni/Downloads/Log/_.err - c:/Users/akashsoni/Downloads/Log/\*.log input\_type: log tail\_files: true registry\_file: "C:/ProgramData/filebeat/registry" output: logstash: # The Logstash hosts hosts: ["localhost:5044"] shipper: logging: files: rotateeverybytes: 10485760 # = 10MB ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2016, 7:31am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/4 "2016-05-23T07:31:42Z")
Why do you have tail\_files enabled? ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:32am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/5 "2016-05-23T07:32:46Z")
just i am trying ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2016, 7:34am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/6 "2016-05-23T07:34:53Z")
tail\_files is the reason the files are not sent: [https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html#\_tail\_files](https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html#_tail_files) ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:35am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/7 "2016-05-23T07:35:47Z")
But,when i false the tail\_files its not working ,i just change the code otherwise that line was comment ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:39am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/8 "2016-05-23T07:39:09Z")
Why first time that it give only one output,at that time my file is [new.It](http://new.It) have to show all five as output ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2016, 7:44am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/9 "2016-05-23T07:44:59Z")
Filebeat persists the state so it can continue where it finished the last time. This state is persisted in the registry file. The path to the registry file is in your case `registry_file: "C:/ProgramData/filebeat/registry"`. If you want a fresh start, remove this file. ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:47am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/10 "2016-05-23T07:47:02Z")
lets try... ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:50am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/11 "2016-05-23T07:50:14Z")
again only one output ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 7:51am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/12 "2016-05-23T07:51:00Z")
Its not work for me for five file it give only one output. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2016, 4:35pm UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/13 "2016-05-23T16:35:41Z")
Can you run filebeat with the options `-e -d "*"` and share the output? Or set the logging level to debug and share the log file. This should show all information needed to get further details on what is going on here. ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 6:00pm UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/14 "2016-05-23T18:00:47Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/5/561faadf1d09eb58fe8fc8a33baf73e1312dbb29.jpg) ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 23, 2016, 6:03pm UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/15 "2016-05-23T18:03:49Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/4/4daaab9e533f9f7f6ca329a13a7d9ba2b1546d6a.jpg) ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 26, 2016, 7:24am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/16 "2016-05-26T07:24:09Z")
Can you please post the log files as text. It is very hard to read the screenshots and makes it impossible to search inside. Also then you can post the hole log file at once. Puting it into a gist and link it here also works. ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 26, 2016, 7:27am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/17 "2016-05-26T07:27:56Z")
I am done with this problem @ruflin . Now I am facing problem of duplicate. I have one folder of log in which there are 10 files and i get 42 hits in my elastic search. ---
**Author:** ![prakashkumar](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Post date:** [May 26, 2016, 7:29am UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/18 "2016-05-26T07:29:23Z")
why it not send 10 log only to ES? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/how-to-insert-file-when-my-file-is-continuously-updating/50639/19 "2017-07-05T21:51:30Z")