If the file 1.txt exists when you start Logstash it will "tail" from the end (it assumes that the existing contents are old and of no interest). If you want the full file to be read and then tailed use start_position => "beginning" BUT if you want to simply read a "done" file then read up on read mode here, the setting and this setting also.