# Logstash isn't recognizing that a file has been updated

**URL:** <https://discuss.elastic.co/t/logstash-isnt-recognizing-that-a-file-has-been-updated/67800>\
**Category:** Logstash\
**Created:** [December 1, 2016, 6:28pm UTC](https://discuss.elastic.co/t/logstash-isnt-recognizing-that-a-file-has-been-updated/67800 "2016-12-01T18:28:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TonyEnnis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonyennis/32/13121_2.png) [@TonyEnnis](https://discuss.elastic.co/u/TonyEnnis)\
**Post date:** [December 1, 2016, 6:28pm UTC](https://discuss.elastic.co/t/logstash-isnt-recognizing-that-a-file-has-been-updated/67800/1 "2016-12-01T18:28:23Z")

</div>

I have a largish file (4G). Each hour, more rows are added. I can process the large file when logstash is started, but regardless of what I do, logstash will not notice updates to the file.

The **.sincedb\_** file has a proper inode (?) value, and the 'last byte read' seems believable.

When I restart logstash, it will process the entire file. My config includes **start\_position =\> "beginning"** but that shouldn't matter because of the **sincedb** file.

The exact same configuration works fine when I use a file that's tiny.

The updated date on the file, the inode value... they all make sense.

Finally, if I restart logstash, it will process the entire file again. My config includes **start\_position =\> "beginning"** but that shouldn't matter because of the **sincedb** file.

So as I type this, it sounds like logstash isn't reading the **sincedb** file.

(Because nothing is easy, and because file doesn't accept URIs, the large file is in a shared folder mounted on my Redhat VM. That is, the file lives on some other server, if that matters.)

Here's my config:

```
input {
        file {
                path => ["/root/syslog.log"]
                type => "unknown"
                start_position => "beginning"
                ignore_older => 0
        }
}
output {
        rabbitmq {
                exchange => "logstash"
                exchange_type => "direct"
                key => "serviceMap"
                host => "rabbitmq.vm"
                }
}

```

EDIT - the **ignore\_older** parameter above is new; it was in my config when I created the post. I saw another reference to this value and how it might be broken, so I added it. For the first time, logstash processed my big file when it was updated. At this time, I cannot tell if logstash is processing the entire file again or not.

EDIT 2 - the file is updated every hour. The 2nd time, logstash did not detect that the file had been changed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2016, 6:28pm UTC](https://discuss.elastic.co/t/logstash-isnt-recognizing-that-a-file-has-been-updated/67800/2 "2016-12-29T18:28:48Z")

</div>

Closed on December 29, 2016, 6:28pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.