# Logstash not indexing new files

**URL:** https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116
**Category:** Logstash
**Created:** [November 15, 2019, 5:59pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116 "2019-11-15T17:59:48Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [November 15, 2019, 5:59pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116/1 "2019-11-15T17:59:48Z")

</div>

Hi, I have a directory that periodically receive new files from another machine, the files start with cpu and the date, ej: cpu\_2019\_11\_03 and are updated daily. yesterday I create the index in elastic search via logstash, but the new files recived today wherent indexed in elastic search, anyone can tell why this happens?

this is my .conf file

input {  
file {  
path =\> "/logs/cpu\*"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
ignore\_older =\> 0  
}  
}

filter {  
csv {  
columns =\> ["horayfecha", "estado", "equipo", "porcentajeCPU"]  
separator =\> " "  
convert =\> { "porcentajeCPU" =\> "float" }  
}  
mutate {  
add\_field =\> {"origen" =\> "alpha"}  
convert =\> {  
"porcentajeCPU" =\> "integer"  
}  
}

```
    date {
            match => ["horayfecha", "HH:mm:ss MM/dd/YYYY"]
            target => "@timestamp"
    }

```

}

output {  
elasticsearch {  
hosts =\> ["foo:9200"]  
index =\> "cpu-%{+YYYY.MM.dd}"  
}

```
   stdout {}

```

}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 15, 2019, 7:35pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116/2 "2019-11-15T19:35:55Z")

</div>

> [@Incauto](#):
>
> ignore\_older =\> 0

On a file input that means to ignore any files more than zero seconds old, which is all files. Remove it.

---

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [November 16, 2019, 5:00pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116/3 "2019-11-16T17:00:18Z")

</div>

Hi, thanks for you answer, but still doesnt work, it just index the logs of the current day

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 17, 2019, 8:19am UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116/4 "2019-11-17T08:19:28Z")

</div>

The index name is defined by the value of the `@timestamp` field, which by default is set to the time the event is read from file. If you expect the index name to be based on e.g. a timestamp in the data you need to extract that timestamp into a separate field and use a `date` filter.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 15, 2019, 8:19am UTC](https://discuss.elastic.co/t/logstash-not-indexing-new-files/208116/5 "2019-12-15T08:19:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
