# Location of Read Pointer for Filebeat

**URL:** <https://discuss.elastic.co/t/location-of-read-pointer-for-filebeat/377346>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 21, 2025, 2:43pm UTC](https://discuss.elastic.co/t/location-of-read-pointer-for-filebeat/377346 "2025-04-21T14:43:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![soren.frederiksen](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@soren.frederiksen](https://discuss.elastic.co/u/soren.frederiksen)\
**Post date:** [April 21, 2025, 2:43pm UTC](https://discuss.elastic.co/t/location-of-read-pointer-for-filebeat/377346/1 "2025-04-21T14:43:10Z")

</div>

We have Filebeat set up to collect logs from AWS and then forward them to Log Stash.

Filebeat is installed on a Windows server set up as an EC2 instance in the AWS cloud. The problem is that if we rebuild the EC2 instance, the Filebeat has to start from the beginning and it takes a while for it to get caught back up. Where exactly is the Read Pointer that Filebeat uses to keep track of where it had last read in the AWS logs?

Is there some documentation on the Filebeat Read Pointer? and how you can move that to a new Windows instance.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 21, 2025, 3:29pm UTC](https://discuss.elastic.co/t/location-of-read-pointer-for-filebeat/377346/2 "2025-04-21T15:29:50Z")

</div>

It is the registry, it is per default in the Filebeat data directory.

I'm not sure where this is in windows because I do not use windows, but you can change it with the setting `filebeat.registry.path: desired-path` in `filebeat.yml`, as mentioned in the [documentation](https://www.elastic.co/docs/reference/beats/filebeat/configuration-general-options).

But I'm not sure this would solver your issue, where are the files you are reading stored? Filebeat tracks the lines read by the inode, if you are recreating the machine all the inodes would also change.

---

<div class="post-metadata">

**Author:** ![soren.frederiksen](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@soren.frederiksen](https://discuss.elastic.co/u/soren.frederiksen)\
**Post date:** [April 21, 2025, 5:20pm UTC](https://discuss.elastic.co/t/location-of-read-pointer-for-filebeat/377346/3 "2025-04-21T17:20:34Z")

</div>

I'll have to check that. Thanks.

I'm reading AWS S3 buckets, and in some cases there are about 3 years worth of data. It'll go through and get caught up, but then if If I have to start a new instance it then has to read through 3 years worth of data to get caught up again.