# Ignore\_inactive is not working

**URL:** <https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 9, 2022, 9:56am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193 "2022-03-09T09:56:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lingminzeng](https://avatars.discourse-cdn.com/v4/letter/l/b5ac83/32.png) [@lingminzeng](https://discuss.elastic.co/u/lingminzeng)\
**Post date:** [March 9, 2022, 9:56am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/1 "2022-03-09T09:56:32Z")

</div>

```auto
#filebeat-8.0.0
filebeat.inputs:

* type: filestream
enabled: true
paths:
  * /var/log/*.log
ignore_inactive: since_last_start

I configure ignore_inactive: since_last_start,but filebeat still read at the beginning position of file.

```

---

<div class="post-metadata">

**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\
**Post date:** [March 9, 2022, 12:07pm UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/2 "2022-03-09T12:07:55Z")

</div>

hello @lingminzeng , welcome to the forum!

> I configure `ignore_inactive: since_last_start`, but filebeat still read at the beginning position of file

this might be the expected behaviour, please see the docs:

> **[filestream input | Filebeat Reference \[8.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.0/filebeat-input-filestream.html#filebeat-input-filestream-ignore-inactive)**

Can you confirm the affected files read at the beginning position were sent to the output and acknowledge by filebeat? If not the offset position where to start from from processing the file will still be always `0`

---

<div class="post-metadata">

**Author:** ![lingminzeng](https://avatars.discourse-cdn.com/v4/letter/l/b5ac83/32.png) [@lingminzeng](https://discuss.elastic.co/u/lingminzeng)\
**Post date:** [March 11, 2022, 6:18am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/3 "2022-03-11T06:18:48Z")

</div>

> [@Andrea\_Spacca](#):
>
> Can you confirm the affected files read at the beginning position were sent to the output and acknowledge by filebeat? If not the offset position where to start from from processing the file will still be always `0`

I can comfirm the affected files read at the begginning postion is sented to the output,but how can I see it is acknowledge by filebeat?

---

<div class="post-metadata">

**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\
**Post date:** [March 17, 2022, 7:24am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/4 "2022-03-17T07:24:36Z")

</div>

@lingminzeng , sorry for the late answer

if you enabled debug log you the following message will be logged:  
`PublishEvents: %d events have been published to elasticsearch in %v.`

Are indeed the logs showing up in kibana?

There could be an error regarding updating the state of the registry for the harvested file, you should look in the logs for anything related to the `registry` and `state`

---

<div class="post-metadata">

**Author:** ![lingminzeng](https://avatars.discourse-cdn.com/v4/letter/l/b5ac83/32.png) [@lingminzeng](https://discuss.elastic.co/u/lingminzeng)\
**Post date:** [March 23, 2022, 6:18am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/5 "2022-03-23T06:18:37Z")

</div>

The problem has been solved，thanks！

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2022, 8:18am UTC](https://discuss.elastic.co/t/ignore-inactive-is-not-working/299193/6 "2022-04-20T08:18:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.