# Logstash File Input Won't Re-read Files

**URL:** <https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684>\
**Category:** Logstash\
**Created:** [February 3, 2020, 7:40pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684 "2020-02-03T19:40:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfisher](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@mfisher](https://discuss.elastic.co/u/mfisher)\
**Post date:** [February 3, 2020, 7:40pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684/1 "2020-02-03T19:40:09Z")

</div>

I've configured logstash to read all .system files from a specific directory and it works for new files.

However after the file is read and indexed it won't re-read a file with the same file name even if I edit it or delete and replace it.

I thought it might have to do with the sincedb however I specify the path to /dev/null and it still has the same behavior.

My input section for logstash.

```
input {
       file {
                mode => "read"
                path => ["/etc/logstash/config/sysinfo/*.system"]
                start_position => "beginning"
                sincedb_path => ["/dev/null"]
                type => "system-info"
       }
}
```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 3, 2020, 8:22pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684/2 "2020-02-03T20:22:17Z")

</div>

it has to do with inode.

[https://discuss.elastic.co/t/file-updates-in-read-mode/202730](https://discuss.elastic.co/t/file-updates-in-read-mode/202730)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 3, 2020, 9:16pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684/3 "2020-02-03T21:16:44Z")

</div>

> [@mfisher](#):
>
> I thought it might have to do with the sincedb however I specify the path to /dev/null and it still has the same behavior.

The sincedb\_path controls where logstash persists the sincedb when it is stopped. The sincedb always exists for the time the file input running. I agree this is probably inode re-use. Given that in read mode the default operation is delete, it is not possible for the re-used inode to contain the same file. There is an [issue](https://github.com/logstash-plugins/logstash-input-file/issues/213) open to get the sincedb cleaned when the file is deleted.

---

<div class="post-metadata">

**Author:** ![mfisher](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@mfisher](https://discuss.elastic.co/u/mfisher)\
**Post date:** [February 3, 2020, 9:51pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684/4 "2020-02-03T21:51:45Z")

</div>

Gotcha, thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2020, 9:51pm UTC](https://discuss.elastic.co/t/logstash-file-input-wont-re-read-files/217684/5 "2020-03-02T21:51:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.