# Logstash not parsing data thats not brand new

**URL:** <https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484>\
**Category:** Logstash\
**Created:** [May 19, 2016, 7:13pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484 "2016-05-19T19:13:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ambrose](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@Ambrose](https://discuss.elastic.co/u/Ambrose)\
**Post date:** [May 19, 2016, 7:13pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484/1 "2016-05-19T19:13:14Z")

</div>

Hello,

My Logstash to Elasticsearch workflow works fine, but only if I take the logs I am sending to Elasticsearch, open them in a text editor, delete them in the original location, and save them back to the area where my logstash .conf file is pointing to. It won't parse the files without doing this and these are brand new files that have never been parsed by Logstash or sent to Elasticsearch before.

Here is what my logstash.conf file looks like:

```
input {
    file {
        path => "/path/to/data/*"
        type => "data"
        start_position => "beginning"
 }

filter {
    if [type] == "data" {
        csv {
            columns => ["Header","Header2","Header3"]
            separator => ","
        }
}
 
output {
    if [type] == "data" {
        elasticsearch {
            action => "index"
            index => "prefetch"
            hosts => "192.168.1.1:9200"
            workers => 1
            user => "user"
            password => "pass"
        }
    }
    stdout {
        codec => rubydebug
    }
}

```

I've got about 10 GB of data in the path, but upon running Logstash with `./bin/logstash -f logstash.conf` I just get the following message in my terminal:

> Settings: Default pipeline workers: 16  
> Pipeline main started

Then Logstash just sits there. Nothing happens. If I take one of the pieces of data from the /path/to/data directory, open it up in sublimetext, delete it from the original path, then save as back to the original path, Logstash then starts parsing it.

I've already deleted all the .sincedb\* files from my $HOME directory, which didn't solve anything, as well as setting `sincedb => "/dev/null/"` in config file, which also didn't work. Please help. How can I get Logstash to parse all these files?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 20, 2016, 5:48am UTC](https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484/2 "2016-05-20T05:48:12Z")

</div>

If you start Logstash with the `--verbose` option the file input will tell you more about what it's doing. My guess is that you need to adjust the file input's `ignore_older` to not skip files older than 24 hours.

---

<div class="post-metadata">

**Author:** ![Ambrose](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@Ambrose](https://discuss.elastic.co/u/Ambrose)\
**Post date:** [May 20, 2016, 2:38pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484/3 "2016-05-20T14:38:20Z")

</div>

Ah man. that worked. awesome. Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/logstash-not-parsing-data-thats-not-brand-new/50484/4 "2017-07-06T04:56:50Z")

</div>