# Ignoring old files

**URL:** <https://discuss.elastic.co/t/ignoring-old-files/158372>\
**Category:** Beats\
**Created:** [November 27, 2018, 3:45pm UTC](https://discuss.elastic.co/t/ignoring-old-files/158372 "2018-11-27T15:45:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tryptych](https://avatars.discourse-cdn.com/v4/letter/t/6bbea6/32.png) [@tryptych](https://discuss.elastic.co/u/tryptych)\
**Post date:** [November 27, 2018, 3:45pm UTC](https://discuss.elastic.co/t/ignoring-old-files/158372/1 "2018-11-27T15:45:28Z")

</div>

I'm new to beats. I am having a lot of trouble getting filebeat to ignore old files. I have **ignore\_older: 48h** in my filebeats.yml but it does not seem to be working. Why? My folder contains millions of files and it's important that filebeat doesn't try to work on them all.

Can anyone point me in the right direction? What is wrong with my config? Copy below:

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/myfolders/log/*/*.log
scan_frequency: 60s
ignore_older: 48h
close_inactive: 72h
compression_level: 0
close_renamed: true
close_removed: true
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
logging.to_syslog: true
output.logstash:
  hosts: ["10.10.10.10:5044"]
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

```

Any tips for a beats rookie would be appreciated!

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [November 30, 2018, 9:43am UTC](https://discuss.elastic.co/t/ignoring-old-files/158372/2 "2018-11-30T09:43:46Z")

</div>

The indentation seems to be incorrect. `scan_frequency`, `ignore_older`, etc are input level options, so they need to be indented accordingly.

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/myfolders/log/*/*.log
  scan_frequency: 60s
  ignore_older: 48h
  close_inactive: 72h
  compression_level: 0
  close_renamed: true
  close_removed: true
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
logging.to_syslog: true
output.logstash:
  hosts: ["10.10.10.10:5044"]
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2018, 11:52am UTC](https://discuss.elastic.co/t/ignoring-old-files/158372/3 "2018-12-28T11:52:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.