# Issue with logstash 8.17.4. Sincedb sometimes does not recognise the correct inode. After logstash restart it works **URL:** \ **Category:** Logstash\ **Created:** [May 6, 2025, 3:56pm UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867 "2025-05-06T15:56:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 6, 2025, 3:56pm UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/1 "2025-05-06T15:56:58Z")
db.log rotates to db\_backup.log. input to logstash ```auto input { file { path => "C:/Program Files (x86)/webserver/db/logs/db.log" exclude => "db_backup.log" type => "db" start_position => "beginning" sincedb_path => "C:/setup/tools/logstash/sincedb_db.log" sincedb_clean_after => "4h" codec => multiline { pattern => "^\d{14}" # Match lines starting with a 14-digit timestamp negate => true # Lines NOT matching the pattern are part of the previous event what => "previous" # Append non-matching lines to the previous event charset => "ISO-8859-1" } } } ``` My sincedb entry before logstash restart ```auto 3336151636-103439-38731776 0 0 3743221 1746535009.097 C:/Program Files (x86)/webserver/db/logs/db.log 3336151636-103510-51970048 0 0 5255427 1746544213.982 C:/Program Files (x86)/webserver/db/logs/db.log 3336151636-103610-29032448 0 0 3033128 1746546108.149 C:/Program Files (x86)/webserver/db/logs/db.log ``` My sincedb entry after logstash restart ```auto 3336151636-103439-38731776 0 0 3743221 1746535009.097 C:/Program Files (x86)/webserver/db/logs/db.log 3336151636-103510-51970048 0 0 5255427 1746544213.982 C:/Program Files (x86)/webserver/db/logs/db.log 3336151636-103610-29032448 0 0 3033128 1746546108.149 C:/Program Files (x86)/webserver/db/logs/db.log 3336151636-103554-71303168 0 0 3896388 1746546378.764 C:/Program Files (x86)/webserver/db/logs/db.log -- this is the right inode entry ``` db.log is pushed to elk. Without logstash restart. I want the correct inode to be updated. Please help ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 6, 2025, 5:38pm UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/2 "2025-05-06T17:38:13Z")
What OS and what filesystem type? The code [suggests](https://github.com/logstash-plugins/logstash-input-file/blob/55a4a7099f05f29351672417036c1342850c7adc/lib/filewatch/winhelper.rb#L168) that it may not work on ReFS, which is used on the server OSes. ---
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 7, 2025, 1:46am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/3 "2025-05-07T01:46:03Z")
This is the windows machine (cloud) and storage is the drive (EBS volumes) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 7, 2025, 1:54am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/4 "2025-05-07T01:54:45Z")
That doesn't answer either of my questions. Which version of Windows, and what filesystem are you using on the EBS volumes? (In File Explorer, if you right click on the disk and select properties, the filesystem type will be labelled "File system".) ---
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 7, 2025, 5:00am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/5 "2025-05-07T05:00:06Z")
Windows 2016 and NTFS . ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 7, 2025, 5:02am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/6 "2025-05-07T05:02:58Z")
Do you mean Windows Server 2016? ---
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 7, 2025, 5:20am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/7 "2025-05-07T05:20:30Z")
I meant Microsoft windows server 2016. ---
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 7, 2025, 4:33pm UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/8 "2025-05-07T16:33:50Z")
@Badger Do we have issue with inode for windows server 2016 and NTFS filessystem. If yes is there any alternate method to solve this issue? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 7, 2025, 5:41pm UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/9 "2025-05-07T17:41:51Z")
There is nothing in the comments in the source code that suggests the input would not work for an NTFS filesystem. ---
**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Post date:** [May 8, 2025, 12:12am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867/10 "2025-05-08T00:12:13Z")
thanks for the update. The output of sincedb file before restart and after restart says that logstash is not able to get the right file identifier when the file rotation happens.