# Logstash on cifs mounted windows drive

**URL:** https://discuss.elastic.co/t/logstash-on-cifs-mounted-windows-drive/256070
**Category:** Logstash
**Created:** [November 20, 2020, 7:14am UTC](https://discuss.elastic.co/t/logstash-on-cifs-mounted-windows-drive/256070 "2020-11-20T07:14:45Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [November 20, 2020, 7:14am UTC](https://discuss.elastic.co/t/logstash-on-cifs-mounted-windows-drive/256070/1 "2020-11-20T07:14:45Z")

</div>

I have to pull in some logs which will be dumped on a shared windows drive.

- The files are small. But their number will be high.
- There is no chance of files appearing again once they have been processed and deleted.
- The file names have timestamp and hence will be unique.

ELK stack is running on Linux. I have been able to mount the windows drive via cifs.

I had in past tried to pull in logs from a shared drive using filebeats running on a windows machine. And I quickly got burnt (Re-Ingesting of existing data).

So I am being extra cautious.  
The plan is:

- Logstash to monitor the shared drive mounted via cifs.
- On finding a file we process it and then let Logstash delete the file from the shared folder to avoid ingesting it again.

This is the config I have now:

```
input
{
	file
	{
		path => "/Data/*.csv"
		start_position => "beginning"
		mode => "read"
		sincedb_path => "/Data/logstash/fileTracker.txt"
		id => "my_file_input"
	}
}

```

Please let me know of any potential issues you see with this setup.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2020, 7:14am UTC](https://discuss.elastic.co/t/logstash-on-cifs-mounted-windows-drive/256070/2 "2020-12-18T07:14:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
