# If filebeat finish to harvest is it mean that logstash finished to process?

**URL:** <https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 6, 2020, 2:45pm UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365 "2020-05-06T14:45:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![111320](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111320/32/66612_2.png) [@111320](https://discuss.elastic.co/u/111320)\
**Post date:** [May 6, 2020, 2:45pm UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365/1 "2020-05-06T14:45:49Z")

</div>

I can see from the "offset" field in the registry file of filebeat that it finish to harvest some file.  
Is it mean that logstash finish to process the file and send it to elasticsearch?

---

<div class="post-metadata">

**Author:** ![111320](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111320/32/66612_2.png) [@111320](https://discuss.elastic.co/u/111320)\
**Post date:** [May 17, 2020, 2:01pm UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365/2 "2020-05-17T14:01:58Z")

</div>

Can someone please confirm or deny it?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [May 18, 2020, 7:17am UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365/3 "2020-05-18T07:17:58Z")

</div>

I think you can deduce the answer from this doc: [https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#at-least-once-delivery](https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#at-least-once-delivery)

---

<div class="post-metadata">

**Author:** ![111320](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111320/32/66612_2.png) [@111320](https://discuss.elastic.co/u/111320)\
**Post date:** [May 18, 2020, 7:44am UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365/4 "2020-05-18T07:44:57Z")

</div>

Thanks Marcin. From this doc I understand that in general the answer is yes, the offset confirms the end of the processing. Of course logstash can take some more millisecond to finish its parsing but in general this is a good sign that the parsing finished.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2020, 7:57am UTC](https://discuss.elastic.co/t/if-filebeat-finish-to-harvest-is-it-mean-that-logstash-finished-to-process/231365/5 "2020-06-15T07:57:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.