# Json filter and .sincedb

**URL:** <https://discuss.elastic.co/t/json-filter-and-sincedb/71267>\
**Category:** Logstash\
**Created:** [January 11, 2017, 6:16pm UTC](https://discuss.elastic.co/t/json-filter-and-sincedb/71267 "2017-01-11T18:16:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [January 11, 2017, 6:16pm UTC](https://discuss.elastic.co/t/json-filter-and-sincedb/71267/1 "2017-01-11T18:16:12Z")

</div>

I am seeing an issue in LS various versions including 2.2 / 2.3.4 and 2.4.1 where if I use the json filter the .sincedb is either not generated or is not observed.

This makes getting LS to start processing my file from the beginning (troubleshooting and dev mode) very difficult. If I remove the json filter the behavior returns to normal and the file is then read from the beginning as per my "file" settings:

```
input {
	
	file {
		path => "C:/ELK/mydata/test.log"
		start_position => "beginning"
		sincedb_path => "C:/ELK/mydata/.sincedb"
		sincedb_write_interval => 2
		ignore_older => 0
	}
}

```

Is this a known issue? Would greatly appreciate any assistance or suggestions.

Thanks.

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [January 12, 2017, 11:22am UTC](https://discuss.elastic.co/t/json-filter-and-sincedb/71267/2 "2017-01-12T11:22:28Z")

</div>

this is not a known issue, can you post/attach the log file when running with `--log.level=debug`?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 11:22am UTC](https://discuss.elastic.co/t/json-filter-and-sincedb/71267/3 "2017-02-09T11:22:30Z")

</div>

Closed on February 9, 2017, 11:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.