# Ignore\_inactive does not work in filebeat with filestream config type **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 12, 2023, 7:00am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111 "2023-12-12T07:00:41Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![josepcorrea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josepcorrea/32/128298_2.png) [@josepcorrea](https://discuss.elastic.co/u/josepcorrea)\ **Post date:** [December 12, 2023, 7:00am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/1 "2023-12-12T07:00:41Z")
When I use the filestream type instead of the log type, filebeat always reads the entire log file from the beginning. ```auto - type: filestream id: test_id enable: true paths: - "/usr/share/filebeat/inputs.d/*.log" parsers: - multiline: type: pattern pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' negate: true match: after ignore_inactive: since_first_start ``` No matter of using `since_first_start` or `since_last_start`, it doesn't work. But when I use log config type with `tail_files:true`, it works normally. ```auto - type: log paths: - "/usr/share/filebeat/inputs.d/*.log" multiline: type: pattern pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}' negate: true match: after enable: true tail_files: true ``` So my question is, how can I configure the filestream type so that filebeat doesn't read my log file from scratch? Thanks to everyone who can solve it . ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [December 13, 2023, 4:24pm UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/2 "2023-12-13T16:24:09Z")
> [@josepcorrea](#): > > filebeat always reads the entire log file from the beginning That's when you restart Filebeat or what is the trigger for that? ---
**Author:** ![josepcorrea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josepcorrea/32/128298_2.png) [@josepcorrea](https://discuss.elastic.co/u/josepcorrea)\ **Post date:** [December 14, 2023, 6:50am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/3 "2023-12-14T06:50:39Z")
> [@josepcorrea](#): > > `ignore_inactive` The problem I have detected is the following: When I use `ignore_inactive: since_first_start`: Reads the updated file lines from startup (does not read the whole file), however, when Filebeat is restarted, it reads the whole file, duplicating the lines. When I use `ignore_inactive: since_last_start`: Reads the lines of the file updated since startup (does not read the whole file), however, when Filebeat is restarted or stopped for a while, it reads the lines again since startup, losing lines. Thanks. ---
**Author:** ![josepcorrea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josepcorrea/32/128298_2.png) [@josepcorrea](https://discuss.elastic.co/u/josepcorrea)\ **Post date:** [December 22, 2023, 11:27am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/4 "2023-12-22T11:27:40Z")
@xeraa Do you have a record of what I am telling you, or is it a bug? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 22, 2023, 12:30pm UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/5 "2023-12-22T12:30:31Z")
> [@josepcorrea](#): > > `/usr/share/filebeat/inputs.d` Quick question, is this a network share? ---
**Author:** ![josepcorrea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josepcorrea/32/128298_2.png) [@josepcorrea](https://discuss.elastic.co/u/josepcorrea)\ **Post date:** [December 22, 2023, 2:45pm UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/6 "2023-12-22T14:45:40Z")
@leandrojmp : No, it is an example, if you configure a file in /home/user/\*.log it has the same behavior. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [December 22, 2023, 9:46pm UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/7 "2023-12-22T21:46:37Z")
> when Filebeat is restarted, it reads the whole file, duplicating the lines. > when Filebeat is restarted or stopped for a while, it reads the lines again since startup, losing lines. It kind of sounds like you don't keep the state between restarts? What's in your registry file and can that be written to and read by Filebeat (and persists between restarts)? [How Filebeat works | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.11/how-filebeat-works.html#_how_does_filebeat_keep_the_state_of_files) for how the state is supposed to work. I kind of doubt that this is generally broken (otherwise all hell would have broken lose) but maybe there's something in your environment that causes an issue there? ---
**Author:** ![josepcorrea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josepcorrea/32/128298_2.png) [@josepcorrea](https://discuss.elastic.co/u/josepcorrea)\ **Post date:** [January 2, 2024, 8:15am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/8 "2024-01-02T08:15:05Z")
Hi @xeraa : Thx for reply, the configuration we have is: ```auto # ============================== Filebeat inputs =============================== filebeat.inputs: ###### INPUT 1 ##### - type: filestream id: bbdd_mw_cpd enabled: true paths: - /opt/oraas/logs/as/wls/*/*access.log tags: ["beats", "bbdd_mw_cpd"] # ============================== Filebeat modules ============================== filebeat.config.modules: # Glob pattern for configuration loading path: ${path.config}/modules.d/*.yml # Set to true to enable config reloading reload.enabled: false # ======================= Elasticsearch template setting ======================= setup.template.settings: index.number_of_shards: 1 setup.kibana: # ------------------------------ Logstash Output ------------------------------- output.logstash: hosts: ["logstash.ocp02.cm1.mercadona.com:4003"] logging.level: info logging.to_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 7 permissions: 0640 ``` The registry files, have the following permissions: Path: /opt/filebeat/data/registry/filebeat ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5e15c3041f491e74539751383a0bce1a7748781.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 30, 2024, 10:15am UTC](https://discuss.elastic.co/t/ignore-inactive-does-not-work-in-filebeat-with-filestream-config-type/349111/9 "2024-01-30T10:15:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.