# Input file reads only newly added files

**URL:** https://discuss.elastic.co/t/input-file-reads-only-newly-added-files/195956
**Category:** Logstash
**Created:** [August 20, 2019, 2:18pm UTC](https://discuss.elastic.co/t/input-file-reads-only-newly-added-files/195956 "2019-08-20T14:18:17Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)
#### Post date: [August 20, 2019, 2:18pm UTC](https://discuss.elastic.co/t/input-file-reads-only-newly-added-files/195956/1 "2019-08-20T14:18:17Z")

</div>

I have a service that outputs two files into a file system, csv and manifest files, both have same file name but different extension.

I need to build a logstash config file that does the following:

- Once the files are written, it reads both files (csv and manifest) that are either located in the main or subdirectories (nested folders)
- Don't read those files if any new pairs are being added, I mean it only reads the newly added ones in any location under the main root.

**Note: both files, csv and manifest, should be read together because the manifest has metadata that helps me to index the csv file when I'll push it to elasticsearch.**

**Question** : sometimes the csv file will take 30 seconds to be written, it is a huge file, so I'm wondering if logstash will start read the file once it's created **OR** once it's closed and the service finished filling it.

Here is the code I'm using, **I managed to read a csv file only, but not sure how to do that for both files as I mentioned above**.

```auto
input {
  file {
    path => "/usr/share/input/**/*.*"
    start_position => beginning
    sincedb_path => "/dev/null"
    discover_interval => 2
    stat_interval => "1 s"
  }
}

filter {
    ...
       .... Code goes here ....
}

output {
    stdout { codec => rubydebug }
    elasticsearch {
        index => "%{blockId}"
        hosts => ["${HOSTS}"]
    }
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 20, 2019, 8:18pm UTC](https://discuss.elastic.co/t/input-file-reads-only-newly-added-files/195956/2 "2019-08-20T20:18:43Z")

</div>

> [@baselai](#):
>
> so I'm wondering if logstash will start read the file once it's created

Yes, it will. Consider a typical use case for logstash - web server logs. logstash will open the file, seek to EOF if configured to do so, and tail the file, reading new lines as they get written. If there are two log files they are read independently and the data is not ordered between them. You cannot tell logstash to process one file and then the other.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2019, 8:18pm UTC](https://discuss.elastic.co/t/input-file-reads-only-newly-added-files/195956/3 "2019-09-17T20:18:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
