# Ignore\_older

**URL:** <https://discuss.elastic.co/t/ignore-older/40526>\
**Category:** Beats\
**Created:** [January 29, 2016, 10:15pm UTC](https://discuss.elastic.co/t/ignore-older/40526 "2016-01-29T22:15:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sd\_karthik](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sd\_karthik](https://discuss.elastic.co/u/sd_karthik)\
**Post date:** [January 29, 2016, 10:15pm UTC](https://discuss.elastic.co/t/ignore-older/40526/1 "2016-01-29T22:15:41Z")

</div>

HI Folks,

What is exactly ignore\_older. I have hourly log files on my server where filebeat is running and streaming logs to logstash.  
I have ignore\_older set to 30m. I stopped logstash process on destination at 12 10PM today adn started it back at 4 10 PM. In the mean time on the filebeat client, 12, 13 , 14, 15 , 16 Hr log files got created. However filebeats was running on the servers(sources).

After starting logstash at 4:10 I thought 12, 13,14,15 hr log files will be lost since it is older than ignore\_older time which is set to 30m. But to my wonder, I see 12,13,14,15,16 log files getting streamed fully after starting the log stash back.

Can someone pls expalin me exactly abt ignore\_older and also provide some good documentation.

Thanks,  
karthik.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [February 1, 2016, 8:11am UTC](https://discuss.elastic.co/t/ignore-older/40526/2 "2016-02-01T08:11:37Z")

</div>

I think best is to have a look at the discussion here: [Logstash File Handler w/ Partially Read Files](https://discuss.elastic.co/t/logstash-file-handler-w-partially-read-files/40418)

In your case ignore\_older didn't have an affect, as filebeat was running all the time and was starting the harvester as needed when the files were updated. Then LS was blocking the output so filebeat was waiting to get it available again. ignore\_older in filebeat has the same behaviour independent if LS is available or not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/ignore-older/40526/3 "2017-07-05T21:56:07Z")

</div>


