# Logstash File input for file rotation

**URL:** <https://discuss.elastic.co/t/logstash-file-input-for-file-rotation/64479>\
**Category:** Logstash\
**Created:** [October 31, 2016, 6:56pm UTC](https://discuss.elastic.co/t/logstash-file-input-for-file-rotation/64479 "2016-10-31T18:56:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ankit\_Jain](https://avatars.discourse-cdn.com/v4/letter/a/96bed5/32.png) [@Ankit\_Jain](https://discuss.elastic.co/u/Ankit_Jain)\
**Post date:** [October 31, 2016, 6:56pm UTC](https://discuss.elastic.co/t/logstash-file-input-for-file-rotation/64479/1 "2016-10-31T18:56:30Z")

</div>

Hi Team,

We have one use case where we need to read the server logs. We only want to read the log once at the same time don't want to loss single event.

All the logging happening in X.log file and which is rolling after every 10MB size. Means, once the 10MB file size is reach, we are renaming a log file as X.log.date.

We are only passing the X.log file in logstash input file path. The issue with only X.log file is that we will loss the events if logstash is down for some time. We can't pass X.log.\* as file input path otherwise it will duplicate the event in case of rollover.

Please suggest what is the proper way to handle such case.

Ankit

---

<div class="post-metadata">

**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Post date:** [February 8, 2017, 3:20pm UTC](https://discuss.elastic.co/t/logstash-file-input-for-file-rotation/64479/2 "2017-02-08T15:20:44Z")

</div>

Hi Ankit,

I have similar problem. Did you solve this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/logstash-file-input-for-file-rotation/64479/3 "2017-07-06T04:28:46Z")

</div>


