# How to make filebeat ship the missed logs of a period?

**URL:** <https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 5, 2021, 6:17pm UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873 "2021-07-05T18:17:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rojin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rojin/32/97697_2.png) [@rojin](https://discuss.elastic.co/u/rojin)\
**Post date:** [July 5, 2021, 6:17pm UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873/1 "2021-07-05T18:17:44Z")

</div>

Hi! I have an index retrieving data from logstash (which gets its data from filebeat itself). There are some logs that were missed by filebeat (because filebeat was installed later on the node) and the dashboards are not showing logs of that specific period of time (before the installation of filebeat). How can I make filebeat ship those logs to logstash without losing current data and dashboards?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [July 6, 2021, 3:32am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873/2 "2021-07-06T03:32:41Z")

</div>

Run a different filebeat instance pointed at the old log files to ingest them.

---

<div class="post-metadata">

**Author:** ![rojin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rojin/32/97697_2.png) [@rojin](https://discuss.elastic.co/u/rojin)\
**Post date:** [July 6, 2021, 7:49am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873/3 "2021-07-06T07:49:07Z")

</div>

Thanks but missed logs are in the middle of the old logs and I do not know if it is okay to run multiple instances of filebeat on the same node. Is it possible to remove that specific filebeat later?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [July 6, 2021, 10:30am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873/4 "2021-07-06T10:30:24Z")

</div>

What do you mean middle of the old logs? If all the logs are in the same directory or even different directories, you can include them in the same filebeat config. It can read multiple files at once. Yes you can have multiple filebeat instances running on the same system. I'd either copy the old logs to a different directory and then run filebeat manually on that directory with the `input.close_eof: true` so that after it reads all the old, static files Filebeat exits. We're doing this for historical AWS logs at the same time Filebeat is ingesting the live/current events from SQS.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2021, 10:31am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873/5 "2021-08-03T10:31:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.