# Log files which sometimes contain no data

**URL:** <https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 25, 2020, 4:41am UTC](https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937 "2020-03-25T04:41:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stantanev](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@stantanev](https://discuss.elastic.co/u/stantanev)\
**Post date:** [March 25, 2020, 4:41am UTC](https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937/1 "2020-03-25T04:41:48Z")

</div>

hi everyone,

how does filebeat handle the case where a different log file is received every hour from a cloud system and sometimes the received files have no data (0kb). ? Do these files with no data cause any issues for filebeat?

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [March 25, 2020, 9:58am UTC](https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937/2 "2020-03-25T09:58:32Z")

</div>

It would be helpful to know a few more details like naming convention of the files, any rotation that might be going on, etc. but based on what you've posted Filebeat should not have any issues.

When a new file is created in the path being watched by Filebeat, Filebeat will detect that file within a certain period of time (determined by the [`scan_frequency`](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#filebeat-input-log-scan-frequency) setting, default value = 10 seconds). and open a new harvester for it. That harvester will try to read the file, line by line, until it reaches EOF. Once it reaches EOF, the harvester will hold on the file handle for a certain period of time (determined by the [`close_inactive`](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#filebeat-input-log-close-inactive) setting, default value = 5 minutes), in case more lines show up. If no new lines show up in that period of time, the file handle is closed. If new lines then get added to the file, a new harvester is started. Filebeat always keeps track of how far into the log file it has read so it can start from that position onwards.

So, in your case, if a 0-byte file shows up, a harvester will get started for it. If the file remains 0 bytes for more than the `close_inactive` duration, the harvester will release the file handle and close itself.

Hope that helps,

Shaunak

---

<div class="post-metadata">

**Author:** ![stantanev](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@stantanev](https://discuss.elastic.co/u/stantanev)\
**Post date:** [March 25, 2020, 10:27pm UTC](https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937/3 "2020-03-25T22:27:21Z")

</div>

Thank you so much! this is exactly what i was after!!! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2020, 10:27pm UTC](https://discuss.elastic.co/t/log-files-which-sometimes-contain-no-data/224937/4 "2020-04-22T22:27:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.