# Logstash behaviour when deleting and adding the same file **URL:** \ **Category:** Logstash\ **Created:** [May 3, 2019, 7:47am UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489 "2019-05-03T07:47:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![gued](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gued](https://discuss.elastic.co/u/gued)\ **Post date:** [May 3, 2019, 7:47am UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/1 "2019-05-03T07:47:11Z")
Hello, I am not sure about Logstash's behaviour when faced with the following example: Suppose you have a file with \> 100 lines of input. Logstash indexes this and the file is removed. What will logstash do if the same file name is created again, now with new content? The time period between the deletion and the creation could be from minutes to days. Thanks in advance. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 3, 2019, 9:35am UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/2 "2019-05-03T09:35:10Z")
It will be treated as a new file as it will have a different inode. ---
**Author:** ![gued](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gued](https://discuss.elastic.co/u/gued)\ **Post date:** [May 3, 2019, 11:29am UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/3 "2019-05-03T11:29:26Z")
Thank you for the quick reply! I do have a follow-up question on that. What happens if you clean out the file? Will Logstash reset it's EOF and parse from the beginning again? Example for clarification: I fill up a file with 100mb of text. Then in my code I clear out the file without removing it. What will Logstash do then? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 3, 2019, 11:54am UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/4 "2019-05-03T11:54:12Z")
If the inode stays the same it should continue reading from the offset it previously reached. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 3, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/5 "2019-05-03T12:40:06Z")
> [@gued](#): > > Suppose you have a file with \> 100 lines of input. Logstash indexes this and the file is removed. What will logstash do if the same file name is created again, now with new content? If you are on a filesystem that uses inode generation numbers then as Christian says, the inode will certainly be different. However, there are filesystems where a new file will just re-use the next available inode number, and then a file input will think it is the same file and expect to continue reading it from the last offset it read from. ---
**Author:** ![gued](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@gued](https://discuss.elastic.co/u/gued)\ **Post date:** [May 3, 2019, 12:56pm UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/6 "2019-05-03T12:56:44Z")
Thank you for the answers. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2019, 12:56pm UTC](https://discuss.elastic.co/t/logstash-behaviour-when-deleting-and-adding-the-same-file/179489/7 "2019-05-31T12:56:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.