# Is there a plugin watch a directory? ( I don't want the file contents, just the filename) **URL:** \ **Category:** Logstash\ **Created:** [May 9, 2016, 9:11pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587 "2016-05-09T21:11:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Post date:** [May 9, 2016, 9:11pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/1 "2016-05-09T21:11:29Z")
The subject says it all. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 9, 2016, 10:01pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/2 "2016-05-09T22:01:47Z")
If you aim to store filenames in elasticsearch, maybe you could use this crawler : > **[dadoonet/fscrawler](https://github.com/dadoonet/fscrawler)** > > fscrawler - Elasticsearch File System Crawler (FS Crawler) And yes, this is not a logstash answer 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 12, 2016, 6:15pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/3 "2016-05-12T18:15:13Z")
What's the exact definition of "watch"? Do you want an event if and only if the set of files in the directory changes? ---
**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Post date:** [May 12, 2016, 9:42pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/4 "2016-05-12T21:42:41Z")
I'd like exactly the behavior of the file plugin except I only want the name of the file. One nice thing about the file input plugin is that it "remembers" in since\_db which files it has already processed. So for example, I could watch directory /a/b/c/d for files matching the pattern "core.\*". I'm considering moving to polling [osquery] given the rich set of data it can provide to me. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 13, 2016, 7:42am UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/5 "2016-05-13T07:42:26Z")
Did you give a try to [https://github.com/dadoonet/fscrawler](https://github.com/dadoonet/fscrawler) ? ---
**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Post date:** [May 13, 2016, 6:09pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/6 "2016-05-13T18:09:46Z")
Fabien, Thank you for taking time to read my question and to make suggestions. I have not had a chance until now to look at fscrawler. It seems that fscrawler will stuff data into ES (+), but I'd rather do some LS style filtering before sending all file updates to ES (-) . If I want to inspect the contents of a file, then LS already does what I want. If I only want to monitor directories for files being added, then (barring an LS plugin), fscrawler using Java seems to be quite a heavy hammer (-). Why wouldn't I just use inotify? My deployment is restricted to Linux and other parts of the toolchain required for my project already depend on inotify being installed and working. With some simple python, I can post events I care about to from a python inotify to an http LS input plugin. ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 13, 2016, 9:18pm UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/7 "2016-05-13T21:18:08Z")
Ok. Given your context, I agree with you, inotify seems to be a good solution. And if you can then post Json document from inotify to logstash, this is perfect. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/is-there-a-plugin-watch-a-directory-i-dont-want-the-file-contents-just-the-filename/49587/8 "2017-07-06T04:57:38Z")